The issue arises from the Grist Core application’s GET /forms endpoint, which reads table and column metadata without applying the document's access rules and does not validate that the requested section is a legitimate form; as a result, a user with only partial read privileges, such as a publicly viewable document, can request the metadata for any widget and reveal the internal table and column structure that should otherwise be concealed, representing an information‑exposure flaw (CWE‑200, CWE‑285).

This vulnerability affects Grist Core under the vendor gristlabs and applies to all installations running versions earlier than 1.7.15, meaning any user who can access a document with limited or public read permissions is potentially exposed.

The CVSS score of 4.3, combined with an EPSS score of less than 1%, indicates a low probability of exploitation; the vulnerability is not listed in the CISA KEV catalog. A user with limited or public read permissions can retrieve table and column metadata via the /forms endpoint, exposing the schema of documents that should otherwise remain private; this information disclosure occurs without requiring elevated privileges or additional actions beyond normal document access.