Which versions of Teable are affected by CVE-2026-56773?

Teable v2 REST API contains a critical access control flaw allowing any authenticated user to bypass authorization controls and access, modify, or delete data across all organizational bases and…. A patch is available.

How to fix or mitigate CVE-2026-56773?

Within 24 hours: Identify all Teable v2 instances in production and audit which users have authenticated API access. Within 7 days: Apply vendor-released patch to all affected deployments. Within 30 days: Review and audit API access logs for unauthorized cross-base or cross-table data operations and update user role-based access policies.

Teable CVE-2026-56773

Q: What is the CVSS score of CVE-2026-56773?

CVE-2026-56773 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-39774 HIGH

Missing Authorization (CWE-862)

2026-06-26 disclosure@vulncheck.com

GHSA-325v-m87x-26cp

Authentication Bypass

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Remotely reachable low-complexity API with only an authenticated low-privileged account (PR:L) and no interaction; missing authz yields high read/write/delete impact across data (C/I/A:H), scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 26, 2026 - 16:16 EUVD

Source Code Evidence Fetched

Jun 26, 2026 - 15:55 vuln.today

Analysis Generated

Jun 26, 2026 - 15:55 vuln.today

DescriptionCVE.org

Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.

AnalysisAI

Broken access control in Teable's v2 REST API lets any authenticated user bypass authorization and act across bases and tables they should not reach. Because the ORPC controller endpoints (e.g. GET /api/v2/tables/get, POST /api/v2/tables/updateRecords) ship without the required @Permissions metadata, an attacker holding even a low-privileged account can enumerate schemas, create tables, and modify or delete arbitrary records. No public exploit is identified at time of analysis, and the issue is not on CISA KEV, but a vendor fix (PR #3285) and patched release are available.

Technical ContextAI

Teable is an open-source, self-hosted Airtable-style database/spreadsheet platform built on a NestJS-style backend that uses ORPC for its v2 REST API. Authorization in this stack is enforced declaratively: handler methods are expected to be decorated with @Permissions metadata that a guard reads to verify the caller's role/scope against the targeted base or table. The root cause is CWE-862 (Missing Authorization): the v2 REST API controller methods omit this @Permissions metadata entirely, so the permission guard has nothing to check and the requests fall through to the underlying service logic. The result is that operations which should be gated per-base/per-table (read schema, create table, update/delete records) execute for any session that passes mere authentication, regardless of whether the user has rights to that resource.

RemediationAI

Upgrade Teable to the patched build release.2026-06-15T04-43-24Z.1912 (https://github.com/teableio/teable/releases/tag/release.2026-06-15T04-43-24Z.1912), which incorporates the authorization fix from PR #3285 (https://github.com/teableio/teable/pull/3285); note the release notes themselves describe only feature/bugfix changes and do not call out the security fix, so verify the deployed image actually contains PR #3285. Until you can patch, reduce exposure by restricting who can authenticate: disable open/self-service user registration so only trusted accounts exist, and place the instance behind network controls or a reverse proxy that limits access to /api/v2/ endpoints (e.g. block or filter the v2 ORPC routes such as /api/v2/tables/* if your clients only use v1) - the trade-off is that any legitimate v2 API consumers will break. Audit existing low-privilege accounts and review records/tables for unauthorized creation, modification, or deletion, since the flaw permits silent cross-base tampering. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/teable-missing-authorization-in-v2-rest-api) for authoritative guidance.