Vulnerabilities CVE-2026-56773

CVE-2026-56773

High

Open

TLP:CLEAR

Teable - Missing Authorization in v2 REST API

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.

Details

CVSS Score: 8.7
EPSS Score ⓘ: 0.37%

30th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Confidence: 90%
Published: Jun 26, 2026
Last Modified: Jul 14, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.