# CVE-2026-53536: Activepieces authorization bypass in step-files download endpoint

Source: https://junglewise.ai/threats/cve-2026-53536-activepieces-authorization-bypass-in-step-files-download-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-53536 · Severity: info · CVSS 5.3 · Published 2026-07-16

Activepieces is an open-source platform used to automate AI workflows. A security flaw in the platform's file download system allowed any registered user to download files belonging to other organizations (tenants) hosted on the same server. While an attacker could not target specific files, they could repeatedly request data to collect a random sample of private workflow attachments from across the entire system.

Technologies: [Activepieces](https://junglewise.ai/threats/technologies/activepieces). Vendors: [Activepieces](https://junglewise.ai/threats/vendors/activepieces).

## Quick answers

**Is CVE-2026-53536 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53536 being exploited in the wild.

**How severe is CVE-2026-53536?** Informational severity, with a CVSS score of 5.3, published 16 July 2026.

**Which products and versions are affected?** Activepieces < 0.83.0.

**Is there a fix for CVE-2026-53536?** A patch was published on 2026-05-06: Version 0.83.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53536 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53536?** Check whether you run Activepieces at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in the `/v1/step-files/signed` endpoint of Activepieces due to insufficient JWT validation and a logic error in the file retrieval service. The endpoint verified the JWT signature but failed to validate the 'audience' claim. Furthermore, the `getFileOrThrow` function in `file.service.ts` lacked a null-check on the `fileId` extracted from the token. When an attacker provides a valid JWT (such as their own session token) that lacks a `fileId` claim, the backend executes a database query for files of type `FLOW_STEP_FILE` without a specific ID filter. This results in PostgreSQL returning the first available file record from the global table, which may belong to any tenant. This allows an authenticated attacker to perform cross-tenant data exfiltration of workflow attachments. The issue is fixed in version 0.83.0 by ensuring the service throws an error if `fileId` is null.

## Affected products

- Activepieces Activepieces < 0.83.0

## Timeline

- 2026-07-13: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: NVD publication date
- 2026-05-06: patched: Version 0.83.0 released

## References

- [https://github.com/activepieces/activepieces/commit/2cb6148010a6c2a22900f4c8b08d75cc5c921d1c](https://github.com/activepieces/activepieces/commit/2cb6148010a6c2a22900f4c8b08d75cc5c921d1c)
- [https://github.com/activepieces/activepieces/commit/afe852f60e39fcc6273d41e11f0765586b5a0e49](https://github.com/activepieces/activepieces/commit/afe852f60e39fcc6273d41e11f0765586b5a0e49)
- [https://github.com/activepieces/activepieces/releases/tag/0.83.0](https://github.com/activepieces/activepieces/releases/tag/0.83.0)
- [https://github.com/activepieces/activepieces/security/advisories/GHSA-9723-fmff-mc24](https://github.com/activepieces/activepieces/security/advisories/GHSA-9723-fmff-mc24)

## Related threats

- [Activepieces path traversal in Code piece sandbox cache](https://junglewise.ai/threats/cve-2026-48499-activepieces-path-traversal-in-code-piece-sandbox-cache)
- [Activepieces path traversal and symlink follow in git-sync](https://junglewise.ai/threats/cve-2026-53535-activepieces-path-traversal-and-symlink-follow-in-git-sync)
- [Activepieces SSRF in File URL Handler](https://junglewise.ai/threats/cve-2026-12813-activepieces-ssrf-in-file-url-handler)