EUVD-2026-102488
GHSA-566j-v842-c9mx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryEnumerate target nodeId values
-
ExploitRequest GET /node/{nodeId}/description
-
ExecutionBypass space-membership and permission checks
-
ImpactDisclose cross-tenant node descriptions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated account on the target APITable instance (PR:L) - any low-privilege user suffices; no admin or special role is needed. No non-default configuration is required: the GET /node/{nodeId}/description endpoint skips space-membership and node-permission checks in default behavior through v1.14.0-beta. Exploitation is most impactful on multi-tenant/shared deployments where spaces belong to different organizations. Limiting factors: the attacker must hold a session on the instance and must know, guess, or enumerate target nodeId values, and the disclosure is confined to node descriptions (datasheet/folder/form metadata) rather than full record contents. |
| Impact | This is a medium-severity information-disclosure flaw (CVSS 4.0 base 5.3) whose signals are internally consistent and point to a real-but-bounded issue rather than a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring an authenticated low-privilege account, with only low confidentiality impact (VC:L) and no integrity or availability impact (VI:N/VA:N) - accurately reflecting a CWE-639 IDOR that leaks node *descriptions* (metadata), not full datasheet records. No EPSS score, SSVC decision, or KEV entry was provided in the input, so exploitation-probability and automatable/technical-impact signals cannot be weighed; absence of KEV means there is no confirmation of active exploitation. A detailed public technical writeup (hackmd) and the exact vulnerable source line are referenced, lowering the barrier to exploitation even though no explicit POC flag was supplied. Net: a genuine cross-tenant authorization gap worth patching for multi-tenant/SaaS APITable deployments, but the low impact scope (descriptions only), authentication requirement, and lack of KEV/EPSS evidence keep this below critical-priority. |
| Exploit ScenarioDerived | A low-privileged but authenticated user of a shared/multi-tenant APITable instance iterates or guesses nodeId values belonging to other spaces and issues GET /node/{nodeId}/description for each. Because the endpoint omits space-membership and node-permission checks, the attacker harvests datasheet, folder, and form descriptions from tenants they should not see. A public technical writeup documents the exact request, so no original research is needed to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Cross-space information disclosure in APITable through 1.14.0-beta lets any authenticated, low-privileged user read node descriptions from other spaces by sending GET /node/{nodeId}/description with a user-controlled nodeId that skips space-membership and node-permission checks (CWE-639). The flaw has the greatest effect on multi-tenant or shared deployments, where descriptions can expose datasheet, folder, and form metadata belonging to another organization. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating a bounded, confidentiality-only issue; no public exploit identified at time of analysis, and no vendor-released patch version was identified at time of analysis, although a technical write-up and a VulnCheck advisory are available.
RemediationAI
No vendor-released patch version was identified at time of analysis, so the priority is to apply an official APITable fix as soon as one is published and to track the VulnCheck advisory at https://www.vulncheck.com/advisories/apitable-through-1.14.0-beta-authorization-bypass-via-get-node-nodeid-description plus the technical write-up at https://hackmd.io/@hieuPenguinnn/apitable-node-description-cross-space-idor. Until a patched release is available, enforce space-membership and node-permission checks at the API gateway or reverse proxy before forwarding GET /node/{nodeId}/description, or temporarily block that endpoint for users who do not need it - the trade-off is that legitimate description retrieval in the UI will be disrupted. Restrict access to the APITable instance to trusted users and avoid broad multi-tenant exposure where possible, which shrinks the attack surface but may limit collaboration. Monitor proxy and application logs for abnormal or high-volume enumeration of nodeId values, especially sequential patterns, to detect abuse, recognizing that this control depends on adequate logging and alerting. Treat node descriptions as potentially exposed metadata and avoid placing secrets in datasheet, folder, or form descriptions; the source-level fix should add an explicit space-membership and node-permission check in NodeController.java around the lines 1043-1057 shown at v1.14.0-beta.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-639 authorization bypass through a user-controlled key, located in APITable's Java workspace backend. The GET /node/{nodeId}/description handler in NodeController.java (lines 1043-1057 of the v1.14.0-beta tree) accepts a caller-supplied nodeId but does not verify that the caller belongs to the space that owns the node or that the caller holds permission on that node, so the lookup returns the description across tenant boundaries. Under the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, exploitation requires a valid low-privileged account on the instance (PR:L) with no user interaction; it is confidentiality-only with low impact because only descriptions (datasheet, folder, and form metadata) are disclosed, not full record contents. The CVSS 4.0 vector also reflects PR:L and VC:L, and practical impact depends on the attacker knowing, guessing, or enumerating valid nodeId values.
Know when Apitable gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint, no user interaction, but requires an authenticated low-privilege account (PR:L); only node descriptions leak, so C:L with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips space membership and node permission checks, to disclose cross-tenant datasheet, folder, and form descriptions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Unauthenticated remote destruction of pending-deletion accounts is possible in APITable through 1.13.0-beta.1, where two
Unauthenticated access to the internal organization loadOrSearch endpoint in APITable through 1.13.0-beta.1 exposes comp
Unauthenticated notification injection in APITable through 1.13.0-beta.1 permits any network-reachable client to write a
Exploit-DB