CVE-2026-80208

Received Received - Intake

Unauthenticated Account Deletion in APITable

Publication date: 2026-08-27

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so both endpoints are reachable by any unauthenticated client that can reach the gateway. An attacker can POST to /api/v1/internal/getUserHistories to enumerate the accounts sitting in the 30-day cooling-off period that follows a deletion request, then POST to /api/v1/internal/users/{userId}/close for each one. The closure path clears the account's email address, phone number and nickname, cancels its space subscriptions, removes its space memberships and deletes its OAuth bindings, so the cooling-off window that exists to let a user reverse a deletion request is bypassed and the account cannot be recovered.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-28

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80208

EUVD

EUVD-2026-67142

Affected Vendors & Products

Vendor	Product	Version / Range
apitable	apitable	to 1.13.0-beta.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-80208 is a missing authentication vulnerability in APITable versions up to 1.13.0-beta.1. It allows unauthenticated attackers to bypass the 30-day cooling-off period for account deletion by exploiting two internal endpoints. The first endpoint, POST /api/v1/internal/getUserHistories, lets attackers list accounts in the cooling-off state. The second, POST /api/v1/internal/users/{userId}/close, permanently deletes those accounts, including emails, phone numbers, and OAuth bindings, making recovery impossible.

Detection Guidance

To detect this vulnerability, check if unauthenticated requests can access the endpoints /api/v1/internal/getUserHistories and /api/v1/internal/users/{userId}/close. Use tools like curl to send POST requests to these endpoints without authentication. Example: curl -X POST http://<target>/api/v1/internal/getUserHistories -H 'Content-Type: application/json' -d '{"limitDays":30}' and curl -X POST http://<target>/api/v1/internal/users/123/close.

Verify if the nginx gateway forwards /api requests to the backend without authentication checks. Inspect nginx configuration for proxy_pass directives pointing to backend services.

Impact Analysis

If you use APITable, an attacker could exploit this to permanently delete your account and all associated data during the cooling-off period. This includes emails, phone numbers, subscriptions, and OAuth connections, preventing you from recovering your account. The attack requires no authentication and can be performed remotely.

Compliance Impact

This vulnerability could violate GDPR's data protection requirements by enabling unauthorized deletion of user data without consent. It may also conflict with HIPAA's integrity and availability principles by allowing permanent loss of critical user information. Organizations using APITable must address this to maintain compliance.

Mitigation Strategies

Immediately restrict access to /api/v1/internal/** routes by requiring authentication. Update nginx configuration to block unauthenticated access to these endpoints. Consider moving internal endpoints to a non-publicly exposed port.

Upgrade APITable to a version that enforces authentication on these endpoints or apply patches from the vendor. Monitor logs for suspicious POST requests to /api/v1/internal/getUserHistories or /api/v1/internal/users/{userId}/close.

Hi! I’m here to help you understand CVE-2026-80208. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70