CVE-2026-125748

CVE-2026-125748CVE-2026-125748

Description

Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. Attackers can pair their own meetingId with a reactableId of another tenant's reflection, comment, or sequential team prompt response to add or remove their reactions.

Scoring

CVSS 4.3 ()
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Last modified2026-11-10
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.