Medium severity4.3NVD Advisory· Published Nov 10, 2026
CVE-2026-125748
CVE-2026-125748
Description
Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. Attackers can pair their own meetingId with a reactableId of another tenant's reflection, comment, or sequential team prompt response to add or remove their reactions.
Affected products
1- Range: <15.21.2
Patches
Vulnerability mechanics
References
6- github.com/ParabolInc/parabol/blob/v15.21.1/packages/server/graphql/public/mutations/addReactjiToReactable.tsnvd
- github.com/ParabolInc/parabol/commit/1f063b2f2768ad3a6138156ddce9d938f58e8005nvd
- github.com/ParabolInc/parabol/issues/13727nvd
- github.com/ParabolInc/parabol/releases/tag/v15.21.2nvd
- hackmd.io/@hieuPenguinnn/parabol-addreactjitoreactable-cross-meeting-idornvd
- www.vulncheck.com/advisories/parabol-before-15.21.2-missing-authorization-via-addreactjitoreactable-mutationnvd
News mentions
0No linked articles in our index yet.