Teable
Monthly
Authenticated users of Teable can rename folders that belong to bases they have no membership in by submitting a folderId from a foreign base to the PATCH /api/base/:baseId/node/folder/:folderId endpoint, which validates the base|update permission only against the baseId in the URL rather than against the base that actually owns the folder. The flaw is an IDOR / authorization bypass (CWE-639) affecting releases prior to release.2026-10-12T12-45-53Z.3331; the vendor-supplied CVSS 4.0 vector scores it 2.3 and our independent CVSS 3.1 assessment scores it AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, reflecting integrity-only impact with no data disclosure or destruction. Exploitation requires a valid Teable session plus discovery of a non-enumerable foreign folderId, so multi-tenant or shared deployments carry the most practical exposure; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
Cross-site scripting in Teable's authentication redirect flow (versions 1.0-1.9.x) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by crafting a login URL with a malicious `redirect` parameter using javascript: or data: URI schemes. The vulnerable component is LoginPage.tsx in the Next.js frontend and the social auth controller adapter in the NestJS backend, neither of which validated the redirect destination before navigating. Publicly available exploit code exists (GitHub gist), but the vulnerability is not listed in CISA KEV and EPSS probability is very low at 0.04% (11th percentile), indicating no confirmed widespread exploitation.
Authenticated users of Teable can rename folders that belong to bases they have no membership in by submitting a folderId from a foreign base to the PATCH /api/base/:baseId/node/folder/:folderId endpoint, which validates the base|update permission only against the baseId in the URL rather than against the base that actually owns the folder. The flaw is an IDOR / authorization bypass (CWE-639) affecting releases prior to release.2026-10-12T12-45-53Z.3331; the vendor-supplied CVSS 4.0 vector scores it 2.3 and our independent CVSS 3.1 assessment scores it AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, reflecting integrity-only impact with no data disclosure or destruction. Exploitation requires a valid Teable session plus discovery of a non-enumerable foreign folderId, so multi-tenant or shared deployments carry the most practical exposure; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
Cross-site scripting in Teable's authentication redirect flow (versions 1.0-1.9.x) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by crafting a login URL with a malicious `redirect` parameter using javascript: or data: URI schemes. The vulnerable component is LoginPage.tsx in the Next.js frontend and the social auth controller adapter in the NestJS backend, neither of which validated the redirect destination before navigating. Publicly available exploit code exists (GitHub gist), but the vulnerability is not listed in CISA KEV and EPSS probability is very low at 0.04% (11th percentile), indicating no confirmed widespread exploitation.