Steedos Platform through version 3.0.15‑beta.51 features an authorization bypass that lets any authenticated user query the reports object to retrieve the definitions of reports created by other tenants. The flaw allows disclosure of report names, descriptions, and the object and field API names used by those reports, exposing metadata that could aid further attacks. This weakness is an example of an authorization bypass (CWE‑863).

The affected system is the Steedos Platform product, supplied by Steedos. All releases up to and including 3.0.15‑beta.51 are vulnerable. The vulnerability exists in the objectql layer that handles reporting APIs and applies to any installation that has the enable_space_global flag set on space‑global objects.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated to a tenant and then can call GET /​api/v1/reports to read the metadata of other tenants’ report definitions. Because the flaw is purely an authorization bypass, there is no direct attack vector from untrusted network input, but it can be leveraged once obtain valid credentials or exploit another authentication weakness.