parabolinc vulnerabilities

Products

• parabolinc/parabol 1

Latest parabolinc CVEs

Newest publication first

1. CVE-2026-125748 Parabol before 15.21.2 Missing Authorization via addReactjiToReactable Mutation

   Published 2026-11-10

   Medium·CVSS 5.3 EPSS 0.26%

   Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. Attackers can pair their own meetingId with a reactableId of another tenan...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.