The vulnerability resides in Lowcoder’s library-query execution endpoint where incorrect authorization checks allow an authenticated administrator or developer within one organization to invoke a library query that belongs to another organization simply by supplying the victim query’s identifier. An attacker who already possesses a valid account with administrative or developer rights can therefore execute arbitrary queries outside their permitted scope, potentially accessing sensitive data or modifying records in other organizations. This flaw effectively bypasses the application’s intended access controls and is a privilege‑escalation vector that can compromise confidentiality and integrity across organizational boundaries.

The affected product is Lowcoder, covering all releases up to and including version 2.4.10. Users running these or earlier versions are subject to the flaw, regardless of the environment in which the application is hosted. No other vendors or products are listed as impacted.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, so the assessed exploitation probability remains unclear. The flaw requires an authenticated user with administrative or developer privileges, meaning that normal users cannot exploit it. However, once a privileged user’s credentials are compromised or if a legitimate administrator misconfigures role boundaries, an attacker can craft a request containing a target organization’s library‑query identifier to exercise the unintended access. The CVSS score of 8.8 indicates high severity, but the ability to execute queries across organizations is a significant attack surface, especially in shared tenant deployments.