APITable CVE-2026-80207

No authentication is required - the CVSS 4.0 vector PR:N confirms unauthenticated exploitation. The sole condition is network reachability to the APITable nginx gateway on its configured HTTP/HTTPS port, which in standard deployments is internet-facing or intranet-wide. No non-default configuration is needed: the requiredLogin = false annotation is present in the default codebase and the nginx proxy-pass rule covering /api/* is part of the shipped gateway configuration. The only exploitation limit is that the attacker must supply a valid registered user ID as the notification target; if user ID enumeration is not possible, the attacker is limited to known or guessed IDs (e.g., ID 1 for the first registered admin). There is no user interaction required on the victim's side for the notification to be stored; the victim need only open their inbox to view it.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N accurately reflects a low-complexity, unauthenticated network attack with constrained direct impact (integrity only, no data exfiltration). The integrity impact is scored Low in the CVSS model, but the real-world social-engineering potential - injecting system-attributed messages to any user - may exceed what VI:L conveys, particularly in deployments where users trust system notifications for account actions or credential prompts. No KEV listing is present, meaning active exploitation has not been confirmed by CISA; no public POC code is identified, though the vulnerability is publicly documented in GitHub issue #1813 and the VulnCheck advisory, making reproduction straightforward for any researcher. EPSS data is not provided in the input; the combination of unauthenticated network access, low complexity, and public disclosure description suggests a moderate-to-elevated exploitation probability over time. The verbatim storage of extras content forwarded to the frontend is a notable secondary signal: if the frontend lacks output encoding, the effective impact could escalate to stored XSS (C:L/I:H territory), but this is inferred from the description and not confirmed by the CVE. The CVSS vector is internally consistent with the description - no conflicts detected.

An external attacker who can reach the APITable nginx gateway sends a crafted POST request to /api/v1/internal/notification/create with an arbitrary target user ID, a compelling message body, and fromUserId set to 0. Because ResourceInterceptor skips validation for the requiredLogin = false handler, the message is written to apitable_player_notification and appears in the victim's inbox attributed to the system sender - indistinguishable from legitimate platform alerts such as password reset prompts or admin notices. No authentication, credentials, or prior system access are required; the attack is automatable and can target all registered users by iterating over user IDs.