CVE-2026-55665

{
  "id": "CVE-2026-55665",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-10T21:16:56.847",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single click. On the account-selection page, /welcome/select-account used its next query parameter as the account buttons' link target. In document tours, the GristDocTour table's Link_URL column became a clickable button, allowing an editor of a shared document to store a javascript URL there that ran when another user opened the document and clicked the tour link. Because the script runs in the victim's authenticated session, it can call Grist APIs as the victim, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15."
    },
    {
      "lang": "es",
      "value": "Grist es un software de hoja de cálculo que utiliza Python como su lenguaje de fórmulas. Antes de la versión 1.7.15, Grist contenía dos vulnerabilidades de cross-site scripting donde un valor controlado por un atacante alcanzaba el href de un enlace sin validación de esquema, por lo que una URL de javascript podía ejecutarse en el origen de Grist de una víctima con un solo clic. En la página de selección de cuenta, /welcome/select-account utilizaba su parámetro de consulta ’next’ como objetivo del enlace de los botones de cuenta. En los recorridos de documentos, la columna Link_URL de la tabla GristDocTour se convertía en un botón clicable, permitiendo a un editor de un documento compartido almacenar una URL de javascript allí que se ejecutaba cuando otro usuario abría el documento y hacía clic en el enlace del recorrido. Debido a que el script se ejecuta en la sesión autenticada de la víctima, puede llamar a las API de Grist como la víctima, leyendo o modificando datos y cambiando la configuración de uso compartido y las reglas de acceso. Un editor de documentos podría, por lo tanto, escalar a acceso de nivel de propietario. Este problema está solucionado en la versión 1.7.15."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "gristlabs",
          "product": "grist-core",
          "versions": [
            {
              "version": "< 1.7.15",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-14T14:11:20.375073Z",
          "id": "CVE-2026-55665",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq",
      "source": "[email protected]"
    }
  ]
}