CVE-2026-86120
Received Received - Intake

APITable NodePermissionGuard Authorization Bypass via Exception Handling

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: VulnCheck

Description
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been explicitly denied access to by exploiting the unhandled exception in the permission guard.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86120
EUVD
EUVD-2026-71952

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apitable apitable to 1.13.0-beta.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-636 When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

APITable through 1.13.0-beta.1 has a fail-open authorization vulnerability in the NodePermissionGuard. When permission lookups throw exceptions, the guard fails to enforce node-level access control. Attackers with valid Fusion API tokens can exploit this to write attachments to private datasheets they are explicitly denied access to.

Detection Guidance

To detect this vulnerability, check if your APITable instance is running a version up to 1.13.0-beta.1. Review logs for failed permission checks in NodePermissionGuard that unexpectedly allow access. Look for unauthorized attachment writes to private datasheets by users with denied permissions.

Impact Analysis

If you use APITable with private datasheets, an attacker with a valid API token could upload attachments to datasheets they should not access. This could lead to unauthorized data modification or exposure, even if your permissions are correctly configured.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data. GDPR requires strict data access controls, and HIPAA mandates protection of health information. Exploits could lead to data breaches, resulting in legal penalties or reputational damage.

Mitigation Strategies

Immediately upgrade APITable to a version beyond 1.13.0-beta.1 where the NodePermissionGuard fix is applied. Review and restrict Fusion API token access. Monitor for unauthorized attachment writes to private datasheets and revoke any suspicious tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86120. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart