CVE-2026-112004
Received Received - Intake

Authorization Bypass in Teable via Folder Renaming

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulnCheck

Description
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-112004
EUVD
EUVD-2026-103457

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
teableio teable 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass vulnerability in Teable before version 2026-10-12T12-45-53Z.3331. It allows authenticated users to rename folders in other bases by providing a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint only checks the baseId in the URL, not the user's actual permissions, enabling unauthorized folder renaming across different bases.

Detection Guidance

Check Teable API logs for suspicious PATCH requests to /api/base/:baseId/node/folder/:folderId where the baseId in the URL does not match the user's authorized base. Look for requests with foreign folderId values from authenticated users.

Impact Analysis

An attacker with an authenticated account and update permissions on one base could rename folders in another base where they are not a member. This could lead to confusion, data integrity issues, or unauthorized modifications to folder structures. However, it does not allow record modification, deletion, privilege escalation, or disclosure of private content.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized modifications to folder structures, potentially affecting data organization and access controls. While it does not directly expose private content, improper folder renaming could lead to misclassification of data, impacting compliance with integrity and access control requirements in standards like GDPR and HIPAA.

Mitigation Strategies
  • Upgrade Teable to version 2026-10-12T12-45-53Z.3331 or later to patch the vulnerability.
  • Review and restrict folder rename permissions in Teable to ensure users can only modify folders in their authorized bases.
  • Monitor API access logs for unauthorized folder rename attempts and investigate any suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112004. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart