Read the docs
TI-2026-40937 Aliases CVE-2026-56773GHSA-325v-m87x-26cp

Teable - Missing Authorization in v2 REST API

Priority LOW 38CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00537 45th percentileScored 2026-11-07
Fix Fixed teable (teableio): 2026-06-15T04-43-24Z.1912

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
teableioteablebefore 2026-06-15T04-43-24Z.19122026-06-15T04-43-24Z.1912Patch availableCNA
  • teable Vendorteableio Affected before 2026-06-15T04-43-24Z.1912 Fixed in 2026-06-15T04-43-24Z.1912 Patch available CNA

Remediation

  • Fix · CNA teable (teableio) Fixed in 2026-06-15T04-43-24Z.1912

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56773
  2. 2026-10-03 Alias added: GHSA-325v-m87x-26cp

References

Other 2

  • TI-2026-08404 teableio teable Sign-up LoginPage.tsx cross site scripting CVSS 4.0MEDIUM 5.3
  • TI-2026-76156 Teable authorization bypass lets users rename folders in other bases CVSS 4.0LOW 2.3
  • TI-2026-40945 Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences