{"id":"CVE-2026-125748","summary":"Parabol before 15.21.2 Missing Authorization via addReactjiToReactable Mutation","details":"Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. Attackers can pair their own meetingId with a reactableId of another tenant's reflection, comment, or sequential team prompt response to add or remove their reactions.","modified":"2026-11-14T02:31:07.087028626Z","published":"2026-11-10T15:22:45.275Z","database_specific":{"cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125748.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125748.json"},{"type":"ADVISORY","url":"https://github.com/ParabolInc/parabol/releases/tag/v15.21.2"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/parabol-addreactjitoreactable-cross-meeting-idor"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125748"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/parabol-before-15.21.2-missing-authorization-via-addreactjitoreactable-mutation"},{"type":"REPORT","url":"https://github.com/ParabolInc/parabol/issues/13727"},{"type":"FIX","url":"https://github.com/ParabolInc/parabol/commit/1f063b2f2768ad3a6138156ddce9d938f58e8005"},{"type":"PACKAGE","url":"https://github.com/ParabolInc/parabol"},{"type":"ARTICLE","url":"https://github.com/ParabolInc/parabol/blob/v15.21.1/packages/server/graphql/public/mutations/addReactjiToReactable.ts#L36-L99"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/parabolinc/parabol","events":[{"introduced":"0"},{"fixed":"1ee5d5dfb148a03ec8fbce9231d70fc6342cd22f"},{"fixed":"1f063b2f2768ad3a6138156ddce9d938f58e8005"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"fixed":"15.21.2"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"1f063b2f2768ad3a6138156ddce9d938f58e8005"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"1ee5d5dfb148a03ec8fbce9231d70fc6342cd22f"}],"source":"REFERENCES_TAG","original_tag":"v15.21.2"}]}}],"versions":["v15.21.1","v15.21.0","v15.20.0","v15.19.0","v15.18.1","v15.18.0","v15.17.1","v15.17.0","v15.16.0","v15.15.2","v15.15.1","v15.15.0","v15.14.1","v15.14.0","v15.13.0","v15.12.1","v15.12.0","v15.11.0","v15.10.0","v15.9.0","v15.8.1","v15.8.0","v15.7.4","v15.7.3","v15.7.2","v15.7.1","v15.7.0","v15.6.0","v15.5.2","v15.5.1","v15.5.0","v15.4.0","v15.3.0","v15.2.5","v15.2.3","v15.2.4","v15.2.2","v15.2.1","v15.2.0","v15.1.1","v15.1.0","v14.4.0","v15.0.0","v14.3.4","v14.3.2","v14.3.3","v14.3.1","v14.3.0","v14.2.0","v14.1.0","v14.0.1","v14.0.0","v13.48.0","v13.47.0","v13.46.1","v13.46.0","v13.45.2","v13.45.1","v13.45.0","v13.44.0","v13.43.0","v13.42.1","v13.42.0","v13.41.0","v13.40.0","v13.39.0","v13.38.2","v13.38.1","v13.38.0","v13.37.0","v13.36.4","v13.36.3","v13.36.2","v13.36.1","v13.36.0","v13.35.0","v13.34.1","v13.34.0","v13.33.0","v13.32.0","v13.31.6","v13.31.5","v13.31.4","v13.31.2","v13.31.3","v13.31.1","v13.31.0","v13.30.0","v13.29.2","v13.29.1","v13.26.6","v13.29.0","v13.28.0","v13.27.0","v13.26.7","v13.26.5","v13.26.4","v13.26.3","v13.26.2","v13.26.1","v13.26.0","v13.25.6","v13.25.5","v13.25.4","v13.25.3","v13.25.2","v13.25.1","v13.25.0","v13.24.2","v13.24.1","v13.24.0","v13.23.0","v13.22.4","v13.22.3","v13.22.2","v13.22.1","v13.22.0","v13.21.1","v13.21.0","v13.20.3","v13.20.2","v13.20.1","v13.20.0","v13.19.0","v13.18.2","v13.18.1","v13.18.0","v13.17.1","v13.17.0","v13.16.0","v13.15.0","v13.14.3","v13.14.2","v13.14.1","v13.14.0","v13.13.0","v13.12.4","v13.12.3","v13.12.2","v13.12.1","v13.12.0","v13.11.4","v13.11.3","v13.11.2","v13.11.1","v13.10.6","v13.11.0","v13.10.5","v13.10.4","v13.10.3","v13.10.2","v13.10.1","v13.10.0","v13.9.2","v13.9.1","v13.9.0","v13.8.0","v13.7.9","v13.7.8","v13.7.7","v13.7.6","v13.7.5","v13.7.4","v13.7.3","v13.7.2","v13.7.1","v13.7.0","v13.6.6","v13.6.5","v13.6.4","v13.6.3","v13.6.2","v13.6.1","v13.6.0","v13.5.3","v13.5.2","v13.5.1","v13.5.0","v13.4.0","v13.3.1","v13.3.0","v13.2.0","v13.1.3","v13.1.2","v13.1.1","v13.1.0","v13.0.1","v13.0.0","v12.10.12","v12.10.11","v12.10.10","v12.10.9","v12.10.8","v12.10.7","v12.10.6","v12.10.5","v12.10.4","v12.10.3","v12.10.2","v12.10.1","v12.10.0","v12.9.4","v12.9.3","v12.9.2","v12.9.1","v12.9.0","v12.8.3","v12.8.2","v12.8.1","v12.8.0","v12.7.2","v12.7.1","v12.7.0","v12.6.1","v12.6.0","v12.5.0","v12.4.0","v12.3.0","v12.2.1","v12.2.0","v12.1.0","v12.0.2","v12.0.1","v12.0.0","v11.13.0","v11.12.0","v11.11.0","v11.10.5","v11.10.4","v11.10.3","v11.10.2","v11.10.1","v11.10.0","v11.9.0","v11.8.0","v11.7.0","v11.6.4","v11.6.3","v11.6.2","v11.6.1","v11.6.0","v11.5.0","v11.4.0","v11.3.2","v11.3.1","v11.3.0","v11.2.0","v11.1.4","v11.1.3","v11.1.2","v11.1.1","v11.1.0","v11.0.1","v11.0.0","v10.38.0","v10.37.2","v10.37.1","v10.37.0","v10.36.1","v10.36.0","v10.35.1","v10.35.0","v10.34.2","v10.34.1","v10.34.0","v10.33.1","v10.33.0","v10.32.1","v10.32.0","v10.31.0","v10.30.0","v10.29.1","v10.29.0","v10.28.5","v10.28.4","v10.28.3","v10.28.2","v10.28.1","v10.28.0","v10.27.10","v10.27.9","v10.27.8","v10.27.7","v10.27.6","v10.27.5","v10.27.4","v10.27.3","v10.27.2","v10.27.1","v10.27.0","v10.26.10","v10.26.9","v10.26.8","v10.26.7","v10.26.6","v10.26.5","v10.26.4","v10.26.3","v10.26.2","v10.26.1","v10.26.0","v10.25.4","v10.25.3","v10.25.2","v10.25.1","v10.25.0","v10.24.1","v10.24.0","v10.23.9","v10.23.8","v10.23.7","v10.23.6","v10.23.5","v10.23.4","v10.23.3","v10.23.2","v10.23.1","v10.23.0","v10.22.1","v10.22.0","v10.21.4","v10.21.3","v10.21.2","v10.21.1","v10.21.0","v10.20.10","v10.20.9","v10.20.8","v10.20.7","v10.20.6","v10.20.5","v10.20.4","v10.20.3","v10.20.2","v10.20.1","v10.20.0","v10.19.3","v10.19.2","v10.19.1","v10.19.0","v10.18.0","v10.17.0","v10.16.3","v10.16.2","v10.16.1","v10.16.0","v10.15.0","v10.14.3","v10.14.2","v10.14.1","v10.14.0","v10.13.0","v10.12.6","v10.12.5","v10.12.4","v10.12.3","v10.12.2","v10.12.1","v10.12.0","v10.11.1","v10.11.0","v10.10.1","v10.10.0","v10.9.6","v10.9.5","v10.9.4","v10.9.3","v10.9.2","v10.9.1","v10.9.0","v10.8.2","v10.8.1","v10.8.0","v10.7.2","v10.7.1","v10.7.0","v10.6.0","v10.5.4","v10.5.3","v10.5.2","v10.5.1","v10.5.0","v10.4.1","v10.4.0","v10.3.6","v10.3.5","v10.3.4","v10.3.3","v10.3.2","v10.3.1","v10.3.0","v10.2.0","v10.1.10","v10.1.9","v10.1.8","v10.1.7","v10.1.6","v10.1.5","v10.1.4","v10.1.3","v10.1.2","v10.1.1","v10.1.0","v10.0.2","v10.0.1","v10.0.0","v9.1.5","v9.1.4","v9.1.3","v9.1.2","v9.1.1","v9.1.0","v9.0.7","v9.0.6","v9.0.5","v9.0.4","v9.0.3","v9.0.2","v9.0.1","v9.0.0","v8.39.2","v8.39.1","v8.39.0","v8.38.0","v8.37.4","v8.37.3","v8.37.2","v8.37.1","v8.37.0","v8.36.1","v8.36.0","v8.35.2","v8.35.1","v8.35.0","v8.34.3","v8.34.2","v8.34.1","v8.34.0","v8.33.1","v8.33.0","v8.32.0","v8.31.0","v8.30.0","v8.29.0","v8.28.1","v8.28.0","v8.27.2","v8.27.1","v8.27.0","v8.26.3","v8.26.2","v8.26.1","v8.26.0","v8.25.4","v8.25.3","v8.25.2","v8.25.1","v8.25.0","v8.24.5","v8.24.4","v8.24.3","v8.24.2","v8.24.1","v8.24.0","v8.23.8","v8.23.7","v8.23.6","v8.23.5","v8.23.4","v8.23.3","v8.23.2","v8.23.1","v8.23.0","v8.22.0","v8.21.1","v8.21.0","v8.20.1","v8.20.0","v8.19.0","v8.18.1","v8.18.0","v8.17.0","v8.16.0","v8.15.0","v8.14.0","v8.13.1","v8.13.0","v8.12.4","v8.12.3","v8.12.2","v8.12.1","v8.12.0","v8.11.0","v8.10.0","v8.9.0","v8.8.0","v8.7.1","v8.7.0","v8.6.1","v8.6.0","v8.5.1","v8.5.0","v8.4.2","v8.4.1","v8.4.0","mattermost-plugin-v0.1.0","v8.3.1","v8.3.0","v8.2.0","v8.1.1","v8.1.0","v8.0.1","v8.0.0","v7.52.1","v7.52.0","v7.51.5","v7.51.4","v7.51.3","v7.51.2","v7.51.1","v7.51.0","v7.50.12","v7.50.11","v7.50.10","v7.50.9","v7.50.8","v7.50.7","v7.50.6","v7.50.5","v7.50.4","v7.50.3","v7.50.2","v7.50.1","v7.50.0","v7.49.1","v7.49.0","v7.48.3","v7.48.2","v7.48.1","v7.48.0","v7.47.5","v7.47.4","v7.47.3","v7.47.2","v7.47.1","v7.47.0","v7.46.3","v7.46.2","v7.46.1","v7.46.0","v7.45.2","v7.45.1","v7.45.0","v7.44.0","v7.43.8","v7.43.7","v7.43.6","v7.43.5","v7.43.4","v7.43.3","v7.43.2","v7.43.1","v7.43.0","v7.42.2","v7.42.1","v7.42.0","v7.41.2","v7.41.1","v7.41.0","v7.40.2","v7.40.1","v7.40.0","v7.39.3","v7.39.2","v7.39.1","v7.39.0","v7.38.11","v7.38.10","v7.38.9","v7.38.8","v7.38.7","v7.38.6","v7.38.5","v7.38.4","v7.38.3","v7.38.2","v7.38.1","v7.38.0","v7.37.8","v7.37.7","v7.37.6","v7.37.5","v7.37.4","v7.37.3","v7.37.2","v7.37.1","v7.37.0","v7.36.0","v7.35.1","v7.35.0","v7.34.0","v7.33.0","v7.32.1","v7.32.0","v7.31.0","v7.30.4","v7.30.3","v7.30.2","v7.30.1","v7.30.0","v7.29.1","v7.29.0","v7.28.1","v7.28.0","v7.27.2","v7.27.1","v7.27.0","v7.26.0","v7.25.4","v7.25.3","v7.25.2","v7.25.1","v7.25.0","v7.24.1","v7.24.0","v7.23.1","v7.23.0","v7.22.4","v7.22.3","v7.22.2","v7.22.1","v7.22.0","v7.21.0","v7.20.0","v7.19.7","v7.19.6","v7.19.5","v7.19.4","v7.19.3","v7.19.2","v7.19.1","v7.19.0","v7.18.1","v7.18.0","v7.16.0","v7.17.0","v7.15.2","v7.15.1","v7.15.0","v7.14.0","v7.13.3","v7.13.2","v7.13.1","v7.13.0","v7.12.4","v7.12.3","v7.12.2","v7.12.1","v7.12.0","v7.10.0","v7.11.2","v7.11.1","v7.11.0","v7.9.0","v7.8.1","v7.8.0","v7.7.0","v7.6.7","v7.6.6","v7.6.5","v7.6.4","v7.6.3","v7.6.2","v7.6.1","v7.6.0","v7.5.0","v7.4.2","v7.4.1","v7.4.0","v7.3.1","v7.3.0","v7.2.1","v7.2.0","v6.118.0","v6.117.0","v6.117.0-rc.1","v6.112.0","v6.107.0","v6.107.0-rc.1","v6.103.0","v6.99.0","v6.99.0-rc.1","v6.96.0","v6.96.0-rc1","v6.92.0","v6.92.0-rc.2","v6.92.0-rc.1","v6.91.0","v6.89.0","v6.89.0-rc.1","v6.86.0","v6.77.0","v6.77.0-rc.1","v6.76.0","v6.76.0-rc.1","v6.75.0","v6.75.0-rc.2","v6.75.0-rc.1","v6.73.0","v6.73.0-rc.2","v6.73.0-rc.1","v6.71.0","v6.71.0-rc.2","v6.71.0-rc.1","v6.70.1","v6.70.0","v6.70.0-rc.1","v6.68.0","v6.68.0-rc.2","v6.68.0-rc.1","v6.67.0","v6.67.0-rc.1","v6.66.0","v6.64.0","v6.64.0-rc.1","v6.63.0","v6.63.0-rc.1","v6.62.2","v6.62.2-rc.1","v6.61.0","v6.61.0-rc.2","v6.61.0-rc.1","v6.59.0","v6.59.0-rc.1","v6.58.0","v6.58.0-rc.1","v6.55.0","v6.55.0-rc.1","v6.52.0","v6.52.0-rc.1","v6.49.0","v6.49.0-rc.1","v6.71.1","v6.47.0","v6.46.0","v6.46.0-rc.1","v6.39.0","v6.39.0-rc.1","v6.38.0","v6.38.0-rc.4","v6.37.0","v6.37.0-rc.1","v6.36.0","v6.36.0-rc.2","v6.36.0-rc.1","v6.34.0","v6.34.0-rc.1","v6.33.1","v6.33.0","v6.33.0-rc.1","v6.31.0","v6.32.0","v6.32.0-rc.1","v6.30.0","v6.30.0-rc.2","v6.30.0-rc.1","v6.28.0","v6.28.0-rc.1","v6.27.0","v6.27.0-rc.1","v6.26.0","v6.26.0-rc.1","v6.25.0","v6.24.0","v6.24.0-rc.4","v6.24.0-rc.3","v6.24.0-rc.2","v6.24.0-rc.1","v6.22.0","v6.21.0","v6.21.0-rc.1","v6.20.0","v6.20.0-rc.1","v6.19.0","v6.17.0","v6.17.0-rc.1","v6.16.1","v6.16.0","v6.11.0","v6.10.0","v6.10.0-rc.1","v6.9.0","v6.7.0","v6.5.0","v6.2.1","v6.0.0","v5.35.0","v5.31.3","v5.31.2","v5.31.1","v5.31.0","v5.29.1","v5.29.0","v5.27.0","v5.25.0","v5.24.0","v5.24.0-rc.1","v5.22.0","v5.18.0","v5.16.1","v5.16.0","v5.14.0-rc.1","v5.13.1","v5.13.1-alpha.0","v5.13.0","v5.12.1","v5.11.0","v5.9.1","v5.9.0","v5.6.0","v5.5.0","v5.0.1","v5.0.0","v4.24.0","v4.23.0","v4.22.0","v4.21.1","v4.21.0","v4.20.1","v4.17.5","v4.17.3","v4.17.0","v4.16.0","v4.15.0","v4.14.0","v4.13.0","v4.12.0","v4.11.0","v4.10.0","v4.9.0","v4.8.1","v4.6.0","v4.6.0-alpha.0","v4.5.3","v4.5.0","v4.4.0","v4.4.0-alpha.0","v4.3.1","v4.3.0","v3.16.0","v3.16.0-0","v3.15.0","v3.13.0","v3.13.0-0","v3.12.0","v3.9.0","v3.8.0","v3.6.0","v3.5.1","v3.5.0","v3.4.0","v3.2.0","v3.2.0-0","v2.20.3","v2.20.0","v2.17.0","v2.14.0","v2.13.1","v2.13.0","v2.11.0","v2.9.0","v2.8.0","v2.6.0","v2.5.0-1","v2.3.0-rc.1","v2.2.0","v2.2.0-0","v2.0.1","v2.0.0","v2.0.0-rc.1","v1.9.0","v1.9.0-1","v1.7.0","v1.7.0-rc.1","v1.6.1","v1.6.0-0","v1.4.0","v1.4.0-rc.1","v1.0.0","v0.31.0-0","v0.30.0","v0.29.1-2","v0.29.1-1","v0.29.1-0","v0.29.0","v0.28.3-3","v0.28.3-2","v0.28.3-1","v0.28.3-0","v0.28.2","v0.27.2","v0.27.1","v0.26.2-0","v0.27.0","v0.26.1","v0.26.0","v0.20.2","v0.20.1","v0.20.0","v0.19.1","v0.18.3","v0.18.2","v0.18.1","v0.17.6","v0.17.5","v0.17.4","v0.17.3","v0.17.2","v0.17.1","v0.17.0","v0.16.12","v0.16.11","v0.16.10","v0.16.9","v0.16.7","v0.16.8","v0.16.5","v0.16.3","v0.16.1","v0.16.0","v0.15.3","v0.15.2","v0.15.0","v0.15.1","v0.14.2","v0.14.1","v0.14.0","v0.13.7","v0.13.6","v0.13.5","v0.13.4","v0.13.3","v0.13.2","v0.13.1","v0.13.0","v0.12.1","v0.12.0","v0.11.0","v0.10.0","v0.9.6","v0.9.5","v0.9.4","v0.9.3","v0.8.1","v0.8.0","v0.7.5","v0.7.4","v0.7.1","v0.7.0","v0.6.3","v0.6.2","v0.6.1","v0.5.3","v0.4.1","v0.4.0","v0.3.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-125748.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}