CVE-2026-80207
Received Received - Intake

APITable Notification Creation Authentication Bypass

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so POST /api/v1/internal/notification/create is reachable by any unauthenticated client that can reach the gateway. An attacker can persist arbitrary notifications in apitable_player_notification against any user ID they name, and because fromUserId can be set to 0 the message is stored with the system sender and renders in the victim's inbox as a legitimate system notification. The body extras content is stored verbatim and forwarded to the frontend.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-09-17
AI Q&A
2026-08-27
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80207
EUVD
EUVD-2026-67141

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apitable apitable 1.13.0
apitable apitable to 1.13.0-beta.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in APITable allows unauthenticated attackers to inject fake system notifications into any user's inbox. The issue occurs because the notification creation endpoint is incorrectly configured to bypass authentication checks. Attackers can send crafted requests to POST /api/v1/internal/notification/create without logging in, then store malicious content in the notification system that appears as a legitimate system message.

Detection Guidance

Check for unauthorized POST requests to /api/v1/internal/notification/create by inspecting web server or application logs for suspicious activity targeting this endpoint. Use network monitoring tools to detect unexpected traffic to the notification creation API path.

Impact Analysis

An attacker could send fake notifications that appear to come from the system, tricking users into clicking malicious links or revealing sensitive information. Since notifications are stored verbatim, the attacker could include phishing content or misleading messages. Users might trust these notifications because they appear to be official system alerts.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or manipulation through fake notifications. GDPR requires protecting personal data integrity, while HIPAA mandates secure communication of health information. Fake notifications could lead to unauthorized data exposure or phishing attacks against users.

Mitigation Strategies

Upgrade APITable to a version beyond 1.13.0-beta.1 where the requiredLogin annotation is corrected. If immediate upgrade is not possible, restrict access to the /api/v1/internal/notification/create endpoint via firewall rules or disable the endpoint entirely.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80207. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart