CVE-2026-56773CWE-862

Teable - Missing Authorization in v2 REST API

High · published June 26, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00537 · 44.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-06-26T14:38Z
EPSS history
Timeline
  • 26 JUN 14:38Z
    Teable - Missing Authorization in v2 REST API
    cvelistv5