Lowcoder version 2.4.10 has an authorization bypass vulnerability in its Query Library feature's API. This flaw allows authenticated users with admin or dev roles to access private query data from other organizations in a multi-tenant instance. The vulnerable API endpoints for metadata retrieval and query execution fail to check if the requested resource belongs to the user's organization. While role-based access is present, it only validates the role against the user's own organization.An attacker with admin or dev privileges in any organization can view the full DSL of other organizations' library queries. They can also execute any library query on the instance, receiving data directly from the affected organization's backend. This can lead to cross-tenant data exposure, modification, or destruction. Additionally, attackers could cause cost abuse by querying paid data sources using another tenant's resources. The vulnerability violates data isolation between organizations.Unfortunately, Lowcoder has not been reachable to coordinate a fix for this issue. Administrators are advised to restrict access to the affected API endpoints and limit application access to trusted users. Reviewing admin and dev role assignments is also recommended. For multi-tenant deployments, isolating tenants into separate instances offers broader protection. If source-code modification is possible, implementing organization-level authorization checks for these API calls is crucial.