Improper Access Control in Teable Exposes Hidden Field Data

Compliance Impact

The vulnerability allows anonymous attackers to access hidden field data that may contain sensitive information such as personally identifiable information (PII) or internal notes. This unauthorized disclosure of confidential data represents a breach of confidentiality controls.

Such a breach can negatively impact compliance with data protection regulations and standards like GDPR and HIPAA, which require strict access controls and protection of sensitive personal and health information.

By enabling unauthorized access to hidden fields, the vulnerability undermines the confidentiality and privacy safeguards mandated by these regulations, potentially leading to regulatory violations and associated penalties.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized access to hidden fields by manipulating the projection parameter in the share view records endpoint. Detection would involve monitoring requests to this endpoint for unusual or unauthorized use of the projection parameter, especially requests that include hidden field IDs enumerated from share metadata.

Specific commands or tools to detect this vulnerability are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The remediation involves restricting the projection parameter in the share view records endpoint so that it only allows access to fields permitted by the view owner. Specifically, the client-supplied projection must be intersected with the allowed field set to prevent unauthorized access to hidden fields.

Updating Teable to version 2026-06-15T04-43-24Z.1912 or later, which contains fixes related to privacy adjustments for anonymous shared views, is recommended.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-56781 is an improper access control vulnerability in Teable versions before 2026-06-15T04-43-24Z.1912. It allows anonymous attackers to access data from fields that are supposed to be hidden in shared views. This happens because the share view records endpoint accepts a client-supplied projection parameter that can override the default masking of hidden fields.

Attackers can enumerate hidden field IDs from the share metadata and specify these IDs in the projection parameter to retrieve the values of fields that the view owner intended to keep private.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a confidentiality breach because attackers can access sensitive information stored in hidden fields without any authentication.

• Attackers can read personally identifiable information (PII) or internal notes that were meant to be restricted.
• Since the vulnerability allows anonymous access, it increases the risk of data exposure to unauthorized parties.

Useful 0 Not Useful 0