CVE-2025-64753: grist-core before 1.7.7 (exclusive), < 1.7.7

Affected technology

grist-core · before 1.7.7 (exclusive)
getgrist

grist-core · < 1.7.7
gristlabs

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or tables to which the user was not supposed to have read access. Vendor/CNA’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality impact as high; integrity and availability impact as none. NVD’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality impact as high; integrity and availability impact as none.