A flaw in Kestra’s previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) allows any authenticated user to read output files from executions belonging to other users within the same tenant. Because the access control check is bypassed, the vulnerability results in a category 3 information disclosure that can expose sensitive data stored in those files. The weakness is an Insecure Direct Object Reference (CWE‑863).

The affected product is Kestra, an open‑source event‑driven orchestration platform available from kestra‑io. Versions prior to 1.0.45 in the main branch and prior to 1.3.21 in the 1.3 branch expose the CVE. All other releases, including those from earlier versions or later patched releases, are not affected.

The vulnerability has a CVSS score of 6.5. The EPSS score is not available and the CVE is not listed in the CISA KEV catalog. Exploitation requires an authenticated user who belongs to the same tenant as the target execution; no additional privileges or remote code execution are needed. Once authenticated, an attacker can retrieve any file accessible via the preview endpoint, resulting in potential confidentiality compromise for the tenant’s data.