CVE-2026-111344

Deferred Deferred - Pending Action

Authorization Bypass in APITable Exposes Node Descriptions

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips space membership and node permission checks, to disclose cross-tenant datasheet, folder, and form descriptions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111344

Affected Vendors & Products

Vendor	Product	Version / Range
apitable	apitable	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

APITable through 1.14.0-beta has an authorization bypass flaw. Authenticated users can read node descriptions from other spaces by providing a user-controlled nodeId. The vulnerability occurs when requesting GET /node/{nodeId}/description, which bypasses space membership and node permission checks, allowing disclosure of cross-tenant datasheet, folder, and form descriptions.

Detection Guidance

To detect this vulnerability, monitor HTTP GET requests to /node/{nodeId}/description endpoints. Check for unusual access patterns or requests from authenticated users attempting to read descriptions outside their assigned spaces. Review server logs for unauthorized access attempts to node descriptions.

Impact Analysis

An attacker with valid credentials could access sensitive information from other tenants, such as datasheet contents, folder names, or form descriptions. This could lead to data leaks, unauthorized access to confidential information, or potential further exploitation of exposed data.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to personal or sensitive data across tenants. Organizations using APITable may face compliance violations, legal penalties, or reputational damage due to potential data breaches.

Mitigation Strategies

Immediately update APITable to the latest version beyond 1.14.0-beta. Implement strict access controls to ensure users can only access node descriptions within their assigned spaces. Restrict GET /node/{nodeId}/description endpoint access to authorized roles only.

Hi! I’m here to help you understand CVE-2026-111344. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70