EUVD-2026-67142
GHSA-84jw-g3q8-wfgq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no privileges or interaction required; confidentiality impact is low (account enumeration only); integrity impact is high due to irreversible account data destruction.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so both endpoints are reachable by any unauthenticated client that can reach the gateway. An attacker can POST to /api/v1/internal/getUserHistories to enumerate the accounts sitting in the 30-day cooling-off period that follows a deletion request, then POST to /api/v1/internal/users/{userId}/close for each one. The closure path clears the account's email address, phone number and nickname, cancels its space subscriptions, removes its space memberships and deletes its OAuth bindings, so the cooling-off window that exists to let a user reverse a deletion request is bypassed and the account cannot be recovered.
AnalysisAI
Unauthenticated remote destruction of pending-deletion accounts is possible in APITable through 1.13.0-beta.1, where two internal user-management endpoints are reachable by any network client without credentials. The InternalUserController annotates both getUserHistories and closePausedUserAccount with requiredLogin = false, causing ResourceInterceptor to skip all session and API-key validation; the bundled nginx gateway forwards every /api request to the backend, giving external attackers a direct path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the APITable nginx gateway - if the instance is internet-facing with default routing, no other prerequisite exists. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.8) accurately reflects the attack surface: no authentication, no special network position, no user interaction, and no prerequisite configuration are required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with HTTP access to an internet-exposed APITable nginx gateway sends an unauthenticated POST to /api/v1/internal/getUserHistories, receiving a list of user IDs for accounts currently in the deletion cooling-off period. The attacker iterates over those IDs and posts to /api/v1/internal/users/{userId}/close for each, which irreversibly wipes each account's personal data, cancels subscriptions, removes workspace memberships, and revokes OAuth bindings. … |
| Remediation | No vendor-released patched version has been confirmed at time of analysis; operators should monitor the upstream repository at https://github.com/apitable/apitable and the VulnCheck advisory at https://www.vulncheck.com/advisories/apitable-through-1.13.0-beta.1-missing-authentication-on-the-internal-account-closure-endpoints for a fix release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify whether your deployment runs APITable 1.13.0-beta.1 or earlier; if affected, implement firewall or WAF rules to restrict external network access to the /api/user/* endpoint paths (specifically getUserHistories and closePausedUserAccount), and enable comprehensive audit logging on all user management API calls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today