APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint
Priority MEDIUM 45CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hierarchy. Attackers can query the endpoint with space identifiers obtained from shared links or public templates to enumerate the complete member directory of any workspace.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00612 49th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-84485
- 2026-10-03 Alias added: GHSA-mmm8-g668-9442
References
Other 4
- https://github.com/apitable/apitable
- https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/internal/controller/InternalOrganizationController.java#L58
- https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/shared/interceptor/ResourceInterceptor.java#L85
- https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/shared/context/LoginContext.java
More apitable vulnerabilities
- TI-2026-55448 APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint CVSS 4.0MEDIUM 6.9
- TI-2026-75078 Authorization bypass in APITable exposes descriptions of other spaces CVSS 4.0MEDIUM 5.3
- TI-2026-55449 APITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints CVSS 4.0HIGH 8.8
- TI-2026-58919 APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-84485 · CVE Program
- CVE-2026-84485 · NVD
- FIRST EPSS
- GHSA-mmm8-g668-9442 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences