Read the docs
TI-2026-08404 Aliases CVE-2026-9566GHSA-6mmc-c65c-3cjp

teableio teable Sign-up LoginPage.tsx cross site scripting

Priority MEDIUM 57CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting, Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.

Summary

A vulnerability was identified in teableio teable up to 1.9.x. This impacts an unknown function of the file apps/nextjs-app/src/features/auth/pages/LoginPage.tsx of the component Sign-up. The manipulation of the argument redirect leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Upgrading to version release.2026-04-21T08-57-20Z.1513 will fix this issue. The affected component should be upgraded. The vendor confirms: "The default branch of teableio/teable is develop, and the reported login redirect issue has already been fixed there. The login redirect flow now validates the redirect parameter with isValidRedirectPath() before navigation, which blocks javascript:, data:, and cross-origin redirects."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00282 20th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed teable (teableio): release.2026-04-21T08-57-20Z.1513

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
teableioteable1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9release.2026-04-21T08-57-20Z.1513Patch availableCNA
  • teable Vendorteableio Affected 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9 Fixed in release.2026-04-21T08-57-20Z.1513 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:teableio:teable:*:*:*:*:*:*:*:*——teableio
  • cpe:2.3:a:teableio:teable:*:*:*:*:*:*:*:* Versions — — ·teableio

Remediation

  • Fix · CNA teable (teableio) Fixed in release.2026-04-21T08-57-20Z.1513

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9566
  2. 2026-10-03 Alias added: GHSA-6mmc-c65c-3cjp

References

Exploit 1

Patch 2

Other 1

  • TI-2026-76156 Teable authorization bypass lets users rename folders in other bases CVSS 4.0LOW 2.3
  • TI-2026-40937 Teable - Missing Authorization in v2 REST API CVSS 4.0HIGH 8.7
  • TI-2026-40945 Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences