Apitable
Monthly
Unauthenticated remote destruction of pending-deletion accounts is possible in APITable through 1.13.0-beta.1, where two internal user-management endpoints are reachable by any network client without credentials. The InternalUserController annotates both getUserHistories and closePausedUserAccount with requiredLogin = false, causing ResourceInterceptor to skip all session and API-key validation; the bundled nginx gateway forwards every /api request to the backend, giving external attackers a direct path. An attacker can enumerate accounts in the 30-day deletion cooling-off window and then permanently destroy each one - wiping PII, cancelling subscriptions, removing space memberships, and revoking OAuth bindings - with no possibility of recovery. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated notification injection in APITable through 1.13.0-beta.1 permits any network-reachable client to write arbitrary messages into any user's inbox by exploiting a missing-authentication annotation on the internal notification create endpoint. The InternalNotifyController marks its create handler with requiredLogin = false, causing ResourceInterceptor to skip all session and API key validation; because the nginx gateway bundled with the product proxies every /api path to the Java backend, the endpoint POST /api/v1/internal/notification/create is fully exposed to unauthenticated callers. Setting fromUserId to 0 makes injected messages render as legitimate system notifications, enabling platform-wide social-engineering attacks; no public exploit code has been identified at time of analysis, though the flaw is documented in a public GitHub issue (no KEV listing).
Unauthenticated remote destruction of pending-deletion accounts is possible in APITable through 1.13.0-beta.1, where two internal user-management endpoints are reachable by any network client without credentials. The InternalUserController annotates both getUserHistories and closePausedUserAccount with requiredLogin = false, causing ResourceInterceptor to skip all session and API-key validation; the bundled nginx gateway forwards every /api request to the backend, giving external attackers a direct path. An attacker can enumerate accounts in the 30-day deletion cooling-off window and then permanently destroy each one - wiping PII, cancelling subscriptions, removing space memberships, and revoking OAuth bindings - with no possibility of recovery. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated notification injection in APITable through 1.13.0-beta.1 permits any network-reachable client to write arbitrary messages into any user's inbox by exploiting a missing-authentication annotation on the internal notification create endpoint. The InternalNotifyController marks its create handler with requiredLogin = false, causing ResourceInterceptor to skip all session and API key validation; because the nginx gateway bundled with the product proxies every /api path to the Java backend, the endpoint POST /api/v1/internal/notification/create is fully exposed to unauthenticated callers. Setting fromUserId to 0 makes injected messages render as legitimate system notifications, enabling platform-wide social-engineering attacks; no public exploit code has been identified at time of analysis, though the flaw is documented in a public GitHub issue (no KEV listing).