Priority MEDIUM 57
APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId.
Vulnerabilities
5 records
TI-2026-58919 CVE-2026-86120 · GHSA-9r64-6j93-9769
APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard
Priority LOW 24
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions.
TI-2026-58062 CVE-2026-84485 · GHSA-mmm8-g668-9442
APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint
Priority MEDIUM 45
APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hierarchy.
TI-2026-55449 CVE-2026-80208 · GHSA-84jw-g3q8-wfgq
APITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints
Priority MEDIUM 44
APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false.
TI-2026-55448 CVE-2026-80207 · GHSA-7cw6-9v6g-p6m5
APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint
Priority HIGH 70
APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false.