APITable EUVD-2026-69797

Exploitation requires a valid space identifier for the target APITable workspace. This identifier is embedded in any shared link or public template URL generated by the workspace - an attacker who can access even a single such link for the target organization has everything needed to enumerate the full member directory. No authentication, account registration, or special privileges are required. Exploitation is bounded to information disclosure only (member names, email addresses, team structure); no write, execute, or administrative capability is exposed through this endpoint. Deployments that have never issued a shared link or public template and restrict network access to internal users are not practically exploitable, as attackers lack a reliable mechanism to discover space identifiers. However, any workspace that has shared content externally should be considered exposed.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) accurately reflects the network-reachable, unauthenticated nature of this flaw and the high confidentiality impact. The primary limiting factor-possession of a space identifier-is not a meaningful barrier: space IDs are embedded in shared links and public templates, which are a core collaborative feature of the platform. Any organization that has ever shared a link externally is therefore exposed. No EPSS data was provided, and neither CISA KEV listing nor public PoC code has been identified, so active exploitation is unconfirmed. Real-world risk is moderate-to-high for organizations running APITable with shared workspaces: harvested email addresses directly enable targeted phishing, credential-stuffing, and social engineering against workspace members. Risk is significantly reduced for fully private, air-gapped deployments with no shared links or public templates, as attackers lack a reliable method to obtain space identifiers in that configuration.

An attacker visits a publicly accessible APITable shared view or template link, extracts the workspace space identifier embedded in the URL, and issues an unauthenticated HTTP GET request to the /internal/org/loadOrSearch endpoint with that identifier. The API responds with the complete member directory-full names, email addresses, and team hierarchy-which the attacker exports for use in targeted spear-phishing campaigns against workspace members. No exploit code is publicly known, but the technique requires only standard HTTP tooling such as curl or Burp Suite.