CVE-2025-64753 grist-core has insufficient access control in endpoints for comparisons between documents and versions

Medium 5.3 Published 13 Nov 2025 Updated 14 Nov 2025

Users with partial read access can view restricted document changes via comparison endpoints, exposing sensitive data.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-64753?

CVE-2025-64753 is a medium-severity missing authorization vulnerability in gristlabs grist-core, published on 13 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or tables to which the user was not supposed to have read access. This was fixed in version 1.7.7 by restricting the `/compare` endpoint to users with full read access. As a workaround, remove sensitive document history using the `/states/remove` endpoint. Another possibility is to block the `/compare` endpoint.

Weakness: CWE-863

Which versions are affected by CVE-2025-64753?

It affects 1 product.

Products include Getgrist Grist-Core.

How do I fix CVE-2025-64753?

No fix has been published for CVE-2025-64753 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-64753 being exploited?

There is no known exploitation of CVE-2025-64753 in the wild and no public exploit code.

Sources

Also known as GHSA-3v78-cw58-v685.