CVE-2026-125748
- Source
- https://cve.org/CVERecord?id=CVE-2026-125748
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-125748.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-125748
- Published
- 2026-11-10T15:22:45Z
- Modified
- 2026-11-14T02:31:07Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Parabol before 15.21.2 Missing Authorization via addReactjiToReactable Mutation
- Details
-
Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. Attackers can pair their own meetingId with a reactableId of another tenant's reflection, comment, or sequential team prompt response to add or remove their reactions.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-639" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125748.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125748.json
- https://github.com/ParabolInc/parabol/releases/tag/v15.21.2
- https://hackmd.io/@hieuPenguinnn/parabol-addreactjitoreactable-cross-meeting-idor
- https://nvd.nist.gov/vuln/detail/CVE-2026-125748
- https://www.vulncheck.com/advisories/parabol-before-15.21.2-missing-authorization-via-addreactjitoreactable-mutation
- https://github.com/ParabolInc/parabol/issues/13727
- https://github.com/ParabolInc/parabol/commit/1f063b2f2768ad3a6138156ddce9d938f58e8005
- https://github.com/ParabolInc/parabol
- https://github.com/ParabolInc/parabol/blob/v15.21.1/packages/server/graphql/public/mutations/addReactjiToReactable.ts#L36-L99
Affected packages
Git / github.com/parabolinc/parabol
Affected ranges
- Type
- GIT
- Repo
- https://github.com/parabolinc/parabol
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "15.21.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "1f063b2f2768ad3a6138156ddce9d938f58e8005" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v15.21.2", "range": [ { "fixed": "1ee5d5dfb148a03ec8fbce9231d70fc6342cd22f" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
mattermost-plugin-v0.*
mattermost-plugin-v0.1.0
v0.*
v0.1.0
v0.10.0
v0.11.0
v0.12.0
v0.12.1
v0.13.0
v0.13.1
v0.13.2
v0.13.3
v0.13.4
v0.13.5
v0.13.6
v0.13.7
v0.14.0
v0.14.1
v0.14.2
v0.15.0
v0.15.1
v0.15.2
v0.15.3
v0.16.0
v0.16.1
v0.16.10
v0.16.11
v0.16.12
v0.16.3
v0.16.5
v0.16.7
v0.16.8
v0.16.9
v0.17.0
v0.17.1
v0.17.2
v0.17.3
v0.17.4
v0.17.5
v0.17.6
v0.18.1
v0.18.2
v0.18.3
v0.19.1
v0.20.0
v0.20.1
v0.20.2
v0.26.0
v0.26.1
v0.26.2-0
v0.27.0
v0.27.1
v0.27.2
v0.28.2
v0.28.3-0
v0.28.3-1
v0.28.3-2
v0.28.3-3
v0.29.0
v0.29.1-0
v0.29.1-1
v0.29.1-2
v0.3.0
v0.30.0
v0.31.0-0
v0.4.0
v0.4.1
v0.5.3
v0.6.1
v0.6.2
v0.6.3
v0.7.0
v0.7.1
v0.7.4
v0.7.5
v0.8.0
v0.8.1
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v1.*
v1.0.0
v1.4.0
v1.4.0-rc.1
v1.6.0-0
v1.6.1
v1.7.0
v1.7.0-rc.1
v1.9.0
v1.9.0-1
v10.*
v10.0.0
v10.0.1
v10.0.2
v10.1.0
v10.1.1
v10.1.10
v10.1.2
v10.1.3
v10.1.4
v10.1.5
v10.1.6
v10.1.7
v10.1.8
v10.1.9
v10.10.0
v10.10.1
v10.11.0
v10.11.1
v10.12.0
v10.12.1
v10.12.2
v10.12.3
v10.12.4
v10.12.5
v10.12.6
v10.13.0
v10.14.0
v10.14.1
v10.14.2
v10.14.3
v10.15.0
v10.16.0
v10.16.1
v10.16.2
v10.16.3
v10.17.0
v10.18.0
v10.19.0
v10.19.1
v10.19.2
v10.19.3
v10.2.0
v10.20.0
v10.20.1
v10.20.10
v10.20.2
v10.20.3
v10.20.4
v10.20.5
v10.20.6
v10.20.7
v10.20.8
v10.20.9
v10.21.0
v10.21.1
v10.21.2
v10.21.3
v10.21.4
v10.22.0
v10.22.1
v10.23.0
v10.23.1
v10.23.2
v10.23.3
v10.23.4
v10.23.5
v10.23.6
v10.23.7
v10.23.8
v10.23.9
v10.24.0
v10.24.1
v10.25.0
v10.25.1
v10.25.2
v10.25.3
v10.25.4
v10.26.0
v10.26.1
v10.26.10
v10.26.2
v10.26.3
v10.26.4
v10.26.5
v10.26.6
v10.26.7
v10.26.8
v10.26.9
v10.27.0
v10.27.1
v10.27.10
v10.27.2
v10.27.3
v10.27.4
v10.27.5
v10.27.6
v10.27.7
v10.27.8
v10.27.9
v10.28.0
v10.28.1
v10.28.2
v10.28.3
v10.28.4
v10.28.5
v10.29.0
v10.29.1
v10.3.0
v10.3.1
v10.3.2
v10.3.3
v10.3.4
v10.3.5
v10.3.6
v10.30.0
v10.31.0
v10.32.0
v10.32.1
v10.33.0
v10.33.1
v10.34.0
v10.34.1
v10.34.2
v10.35.0
v10.35.1
v10.36.0
v10.36.1
v10.37.0
v10.37.1
v10.37.2
v10.38.0
v10.4.0
v10.4.1
v10.5.0
v10.5.1
v10.5.2
v10.5.3
v10.5.4
v10.6.0
v10.7.0
v10.7.1
v10.7.2
v10.8.0
v10.8.1
v10.8.2
v10.9.0
v10.9.1
v10.9.2
v10.9.3
v10.9.4
v10.9.5
v10.9.6
v11.*
v11.0.0
v11.0.1
v11.1.0
v11.1.1
v11.1.2
v11.1.3
v11.1.4
v11.10.0
v11.10.1
v11.10.2
v11.10.3
v11.10.4
v11.10.5
v11.11.0
v11.12.0
v11.13.0
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.4.0
v11.5.0
v11.6.0
v11.6.1
v11.6.2
v11.6.3
v11.6.4
v11.7.0
v11.8.0
v11.9.0
v12.*
v12.0.0
v12.0.1
v12.0.2
v12.1.0
v12.10.0
v12.10.1
v12.10.10
v12.10.11
v12.10.12
v12.10.2
v12.10.3
v12.10.4
v12.10.5
v12.10.6
v12.10.7
v12.10.8
v12.10.9
v12.2.0
v12.2.1
v12.3.0
v12.4.0
v12.5.0
v12.6.0
v12.6.1
v12.7.0
v12.7.1
v12.7.2
v12.8.0
v12.8.1
v12.8.2
v12.8.3
v12.9.0
v12.9.1
v12.9.2
v12.9.3
v12.9.4
v13.*
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.1.2
v13.1.3
v13.10.0
v13.10.1
v13.10.2
v13.10.3
v13.10.4
v13.10.5
v13.10.6
v13.11.0
v13.11.1
v13.11.2
v13.11.3
v13.11.4
v13.12.0
v13.12.1
v13.12.2
v13.12.3
v13.12.4
v13.13.0
v13.14.0
v13.14.1
v13.14.2
v13.14.3
v13.15.0
v13.16.0
v13.17.0
v13.17.1
v13.18.0
v13.18.1
v13.18.2
v13.19.0
v13.2.0
v13.20.0
v13.20.1
v13.20.2
v13.20.3
v13.21.0
v13.21.1
v13.22.0
v13.22.1
v13.22.2
v13.22.3
v13.22.4
v13.23.0
v13.24.0
v13.24.1
v13.24.2
v13.25.0
v13.25.1
v13.25.2
v13.25.3
v13.25.4
v13.25.5
v13.25.6
v13.26.0
v13.26.1
v13.26.2
v13.26.3
v13.26.4
v13.26.5
v13.26.6
v13.26.7
v13.27.0
v13.28.0
v13.29.0
v13.29.1
v13.29.2
v13.3.0
v13.3.1
v13.30.0
v13.31.0
v13.31.1
v13.31.2
v13.31.3
v13.31.4
v13.31.5
v13.31.6
v13.32.0
v13.33.0
v13.34.0
v13.34.1
v13.35.0
v13.36.0
v13.36.1
v13.36.2
v13.36.3
v13.36.4
v13.37.0
v13.38.0
v13.38.1
v13.38.2
v13.39.0
v13.4.0
v13.40.0
v13.41.0
v13.42.0
v13.42.1
v13.43.0
v13.44.0
v13.45.0
v13.45.1
v13.45.2
v13.46.0
v13.46.1
v13.47.0
v13.48.0
v13.5.0
v13.5.1
v13.5.2
v13.5.3
v13.6.0
v13.6.1
v13.6.2
v13.6.3
v13.6.4
v13.6.5
v13.6.6
v13.7.0
v13.7.1
v13.7.2
v13.7.3
v13.7.4
v13.7.5
v13.7.6
v13.7.7
v13.7.8
v13.7.9
v13.8.0
v13.9.0
v13.9.1
v13.9.2
v14.*
v14.0.0
v14.0.1
v14.1.0
v14.2.0
v14.3.0
v14.3.1
v14.3.2
v14.3.3
v14.3.4
v14.4.0
v15.*
v15.0.0
v15.1.0
v15.1.1
v15.10.0
v15.11.0
v15.12.0
v15.12.1
v15.13.0
v15.14.0
v15.14.1
v15.15.0
v15.15.1
v15.15.2
v15.16.0
v15.17.0
v15.17.1
v15.18.0
v15.18.1
v15.19.0
v15.2.0
v15.2.1
v15.2.2
v15.2.3
v15.2.4
v15.2.5
v15.20.0
v15.21.0
v15.21.1
v15.3.0
v15.4.0
v15.5.0
v15.5.1
v15.5.2
v15.6.0
v15.7.0
v15.7.1
v15.7.2
v15.7.3
v15.7.4
v15.8.0
v15.8.1
v15.9.0
v2.*
v2.0.0
v2.0.0-rc.1
v2.0.1
v2.11.0
v2.13.0
v2.13.1
v2.14.0
v2.17.0
v2.2.0
v2.2.0-0
v2.20.0
v2.20.3
v2.3.0-rc.1
v2.5.0-1
v2.6.0
v2.8.0
v2.9.0
v3.*
v3.12.0
v3.13.0
v3.13.0-0
v3.15.0
v3.16.0
v3.16.0-0
v3.2.0
v3.2.0-0
v3.4.0
v3.5.0
v3.5.1
v3.6.0
v3.8.0
v3.9.0
v4.*
v4.10.0
v4.11.0
v4.12.0
v4.13.0
v4.14.0
v4.15.0
v4.16.0
v4.17.0
v4.17.3
v4.17.5
v4.20.1
v4.21.0
v4.21.1
v4.22.0
v4.23.0
v4.24.0
v4.3.0
v4.3.1
v4.4.0
v4.4.0-alpha.0
v4.5.0
v4.5.3
v4.6.0
v4.6.0-alpha.0
v4.8.1
v4.9.0
v5.*
v5.0.0
v5.0.1
v5.11.0
v5.12.1
v5.13.0
v5.13.1
v5.13.1-alpha.0
v5.14.0-rc.1
v5.16.0
v5.16.1
v5.18.0
v5.22.0
v5.24.0
v5.24.0-rc.1
v5.25.0
v5.27.0
v5.29.0
v5.29.1
v5.31.0
v5.31.1
v5.31.2
v5.31.3
v5.35.0
v5.5.0
v5.6.0
v5.9.0
v5.9.1
v6.*
v6.0.0
v6.10.0
v6.10.0-rc.1
v6.103.0
v6.107.0
v6.107.0-rc.1
v6.11.0
v6.112.0
v6.117.0
v6.117.0-rc.1
v6.118.0
v6.16.0
v6.16.1
v6.17.0
v6.17.0-rc.1
v6.19.0
v6.2.1
v6.20.0
v6.20.0-rc.1
v6.21.0
v6.21.0-rc.1
v6.22.0
v6.24.0
v6.24.0-rc.1
v6.24.0-rc.2
v6.24.0-rc.3
v6.24.0-rc.4
v6.25.0
v6.26.0
v6.26.0-rc.1
v6.27.0
v6.27.0-rc.1
v6.28.0
v6.28.0-rc.1
v6.30.0
v6.30.0-rc.1
v6.30.0-rc.2
v6.31.0
v6.32.0
v6.32.0-rc.1
v6.33.0
v6.33.0-rc.1
v6.33.1
v6.34.0
v6.34.0-rc.1
v6.36.0
v6.36.0-rc.1
v6.36.0-rc.2
v6.37.0
v6.37.0-rc.1
v6.38.0
v6.38.0-rc.4
v6.39.0
v6.39.0-rc.1
v6.46.0
v6.46.0-rc.1
v6.47.0
v6.49.0
v6.49.0-rc.1
v6.5.0
v6.52.0
v6.52.0-rc.1
v6.55.0
v6.55.0-rc.1
v6.58.0
v6.58.0-rc.1
v6.59.0
v6.59.0-rc.1
v6.61.0
v6.61.0-rc.1
v6.61.0-rc.2
v6.62.2
v6.62.2-rc.1
v6.63.0
v6.63.0-rc.1
v6.64.0
v6.64.0-rc.1
v6.66.0
v6.67.0
v6.67.0-rc.1
v6.68.0
v6.68.0-rc.1
v6.68.0-rc.2
v6.7.0
v6.70.0
v6.70.0-rc.1
v6.70.1
v6.71.0
v6.71.0-rc.1
v6.71.0-rc.2
v6.71.1
v6.73.0
v6.73.0-rc.1
v6.73.0-rc.2
v6.75.0
v6.75.0-rc.1
v6.75.0-rc.2
v6.76.0
v6.76.0-rc.1
v6.77.0
v6.77.0-rc.1
v6.86.0
v6.89.0
v6.89.0-rc.1
v6.9.0
v6.91.0
v6.92.0
v6.92.0-rc.1
v6.92.0-rc.2
v6.96.0
v6.96.0-rc1
v6.99.0
v6.99.0-rc.1
v7.*
v7.10.0
v7.11.0
v7.11.1
v7.11.2
v7.12.0
v7.12.1
v7.12.2
v7.12.3
v7.12.4
v7.13.0
v7.13.1
v7.13.2
v7.13.3
v7.14.0
v7.15.0
v7.15.1
v7.15.2
v7.16.0
v7.17.0
v7.18.0
v7.18.1
v7.19.0
v7.19.1
v7.19.2
v7.19.3
v7.19.4
v7.19.5
v7.19.6
v7.19.7
v7.2.0
v7.2.1
v7.20.0
v7.21.0
v7.22.0
v7.22.1
v7.22.2
v7.22.3
v7.22.4
v7.23.0
v7.23.1
v7.24.0
v7.24.1
v7.25.0
v7.25.1
v7.25.2
v7.25.3
v7.25.4
v7.26.0
v7.27.0
v7.27.1
v7.27.2
v7.28.0
v7.28.1
v7.29.0
v7.29.1
v7.3.0
v7.3.1
v7.30.0
v7.30.1
v7.30.2
v7.30.3
v7.30.4
v7.31.0
v7.32.0
v7.32.1
v7.33.0
v7.34.0
v7.35.0
v7.35.1
v7.36.0
v7.37.0
v7.37.1
v7.37.2
v7.37.3
v7.37.4
v7.37.5
v7.37.6
v7.37.7
v7.37.8
v7.38.0
v7.38.1
v7.38.10
v7.38.11
v7.38.2
v7.38.3
v7.38.4
v7.38.5
v7.38.6
v7.38.7
v7.38.8
v7.38.9
v7.39.0
v7.39.1
v7.39.2
v7.39.3
v7.4.0
v7.4.1
v7.4.2
v7.40.0
v7.40.1
v7.40.2
v7.41.0
v7.41.1
v7.41.2
v7.42.0
v7.42.1
v7.42.2
v7.43.0
v7.43.1
v7.43.2
v7.43.3
v7.43.4
v7.43.5
v7.43.6
v7.43.7
v7.43.8
v7.44.0
v7.45.0
v7.45.1
v7.45.2
v7.46.0
v7.46.1
v7.46.2
v7.46.3
v7.47.0
v7.47.1
v7.47.2
v7.47.3
v7.47.4
v7.47.5
v7.48.0
v7.48.1
v7.48.2
v7.48.3
v7.49.0
v7.49.1
v7.5.0
v7.50.0
v7.50.1
v7.50.10
v7.50.11
v7.50.12
v7.50.2
v7.50.3
v7.50.4
v7.50.5
v7.50.6
v7.50.7
v7.50.8
v7.50.9
v7.51.0
v7.51.1
v7.51.2
v7.51.3
v7.51.4
v7.51.5
v7.52.0
v7.52.1
v7.6.0
v7.6.1
v7.6.2
v7.6.3
v7.6.4
v7.6.5
v7.6.6
v7.6.7
v7.7.0
v7.8.0
v7.8.1
v7.9.0
v8.*
v8.0.0
v8.0.1
v8.1.0
v8.1.1
v8.10.0
v8.11.0
v8.12.0
v8.12.1
v8.12.2
v8.12.3
v8.12.4
v8.13.0
v8.13.1
v8.14.0
v8.15.0
v8.16.0
v8.17.0
v8.18.0
v8.18.1
v8.19.0
v8.2.0
v8.20.0
v8.20.1
v8.21.0
v8.21.1
v8.22.0
v8.23.0
v8.23.1
v8.23.2
v8.23.3
v8.23.4
v8.23.5
v8.23.6
v8.23.7
v8.23.8
v8.24.0
v8.24.1
v8.24.2
v8.24.3
v8.24.4
v8.24.5
v8.25.0
v8.25.1
v8.25.2
v8.25.3
v8.25.4
v8.26.0
v8.26.1
v8.26.2
v8.26.3
v8.27.0
v8.27.1
v8.27.2
v8.28.0
v8.28.1
v8.29.0
v8.3.0
v8.3.1
v8.30.0
v8.31.0
v8.32.0
v8.33.0
v8.33.1
v8.34.0
v8.34.1
v8.34.2
v8.34.3
v8.35.0
v8.35.1
v8.35.2
v8.36.0
v8.36.1
v8.37.0
v8.37.1
v8.37.2
v8.37.3
v8.37.4
v8.38.0
v8.39.0
v8.39.1
v8.39.2
v8.4.0
v8.4.1
v8.4.2
v8.5.0
v8.5.1
v8.6.0
v8.6.1
v8.7.0
v8.7.1
v8.8.0
v8.9.0
v9.*
v9.0.0
v9.0.1
v9.0.2
v9.0.3
v9.0.4
v9.0.5
v9.0.6
v9.0.7
v9.1.0
v9.1.1
v9.1.2
v9.1.3
v9.1.4
v9.1.5