Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the shared signing secret but did not check the token's audience, and combined with a missing null-check on the decoded fileId, this allowed any caller holding any valid Activepieces JWT (including a freshly created user's own access token) to receive a step-file belonging to another tenant. The file returned was whatever PostgreSQL happened to scan first for type = FLOW_STEP_FILE, varying over time as the database changed, so an authenticated user could obtain step-file attachments belonging to other tenants on the same instance; the attacker could not target a specific victim or file, and the access was read-only with no integrity or availability impact. This issue is fixed in version 0.83.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-53536 Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the sha… https://www.cve.org/CVERecord?id=CVE-2026-53536
Post summary
The text announces CVE-2026-53536, a flaw in Activepieces’ signed download endpoint prior to version 0.83.0.
🚨*CVE* CVE-2026-53536 Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the sha… https://www.cve.org/CVERecord?id=CVE-2026-53536 ----- Traducción: CVE-2026-53536 Act… http://infoflow.cloud`
Post summary
The text announces CVE‑2026‑53536, describing a flaw in Activepieces’ download endpoint before version 0.83.0, but does not provide a PoC, active exploitation evidence, or patch details.