APITable CVE-2026-80208

Exploitation requires network reachability to the APITable nginx gateway - if the instance is internet-facing with default routing, no other prerequisite exists. No authentication of any kind is needed because the requiredLogin = false annotation causes ResourceInterceptor to bypass all session and API-key validation before either endpoint executes. There is no special configuration to enable, no specific platform version of the client, and no required user interaction. The primary limiting factor is network isolation: deployments where the nginx gateway is not externally accessible (e.g., fully air-gapped or internal-only) require an attacker to first obtain a foothold on that network segment. Only accounts in the 30-day deletion cooling-off period are surfaced by the enumeration endpoint, though the close endpoint is callable with any userId obtained by other means.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.8) accurately reflects the attack surface: no authentication, no special network position, no user interaction, and no prerequisite configuration are required. The impact split - VC:L for account enumeration and VI:H for irreversible data destruction - matches the two-phase nature of the attack. No EPSS score was included in the intelligence feed, no CISA KEV entry exists, and no public POC has been identified, which moderates immediate exploitation pressure. However, the attack requires only two standard HTTP POST requests and no tooling beyond curl, meaning the practical barrier to exploitation is extremely low; any operator running a public-facing APITable instance should treat remediation as urgent regardless of the absence of confirmed in-the-wild exploitation. The CVSS vector and description are fully consistent with one another - there is no conflict between the stated network attack vector and the actual attack path described.

An attacker with HTTP access to an internet-exposed APITable nginx gateway sends an unauthenticated POST to /api/v1/internal/getUserHistories, receiving a list of user IDs for accounts currently in the deletion cooling-off period. The attacker iterates over those IDs and posts to /api/v1/internal/users/{userId}/close for each, which irreversibly wipes each account's personal data, cancels subscriptions, removes workspace memberships, and revokes OAuth bindings. No exploit code has been publicly released at time of analysis, but the attack requires only standard HTTP tooling and carries no prerequisite knowledge of target accounts beyond what the enumeration endpoint discloses.