CVE-2026-119759 TrailBase 0.28.2 < 0.35.10 IDOR via Record API File Column
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119759?
CVE-2026-119759 is a high-severity vulnerability in trailbaseio trailbase, published on 9 Nov 2026.
Official description
TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference in std.FileUpload columns, where the Record API accepts attacker-supplied object-store file ids on insert and update without ownership validation. An authenticated attacker who can read a victim’s row can recover its stripped file id via a $like filter and then permanently delete or orphan the victim’s file by deleting or nulling a record they own.
Weakness: CWE-639
Which versions are affected by CVE-2026-119759?
How do I fix CVE-2026-119759?
No fix has been published for CVE-2026-119759 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119759 being exploited?
There is no known exploitation of CVE-2026-119759 in the wild and no public exploit code.
Sources
Also known as GHSA-cr83-43p9-27qg.