steedos vulnerabilities

Products

• steedos-platform 2
• steedos 1

Latest steedos CVEs

Newest publication first

1. CVE-2026-111666 Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API

   Published 2026-10-16

   Medium·CVSS 5.3 EPSS 0.27%

   Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on...

2. CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

   Published 2026-09-15

   Medium·CVSS 5.3 EPSS 0.34%

   Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequenc...

3. CVE-2020-35666 Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedos_base.js mishandles req.body validation, as demonstrated by MongoDB...

   Published 2020-12-23

   High·CVSS 8.8 EPSS 1.1%

   Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedos_base.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id[$ne]=1 value.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.