Teable v2 REST API Authorization Bypass via Missing Permissions

Executive Summary

The vulnerability in Teable's v2 REST API controller is due to missing @Permissions metadata on ORPC endpoints. This absence causes a lack of authorization checks, allowing any authenticated user to bypass these controls.

As a result, attackers can perform unauthorized actions such as reading table schemas, creating new tables, and modifying or deleting records across different bases and tables using endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a significant impact by allowing any authenticated user to bypass authorization and gain unauthorized access to sensitive data and operations.

• Attackers can read table schemas, exposing database structure and potentially sensitive metadata.
• They can create new tables, which might be used to manipulate or corrupt data.
• They can modify or delete records across various bases and tables, leading to data loss, corruption, or unauthorized data manipulation.

Given the high CVSS score of 8.7, this vulnerability poses a critical risk to data integrity, confidentiality, and availability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows any authenticated user to bypass authorization checks and perform unauthorized actions such as reading table schemas, creating tables, and modifying or deleting records across bases and tables.

Such unauthorized access and modification of data could lead to violations of data protection regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data.

However, the provided information does not explicitly state the impact on compliance with these standards.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-56773 vulnerability in Teable's v2 REST API, you should upgrade to the fixed version released after 2026-06-15T04-43-24Z.1912, as this release addresses the missing authorization checks.

Since the vulnerability allows any authenticated user to bypass authorization checks, restricting access to the API endpoints to trusted users only and monitoring API usage for suspicious activity can also help reduce risk until the patch is applied.

Useful 0 Not Useful 0