Authorization Bypass in APITable Affects User Data Privacy
CVE-2026-111344

5.3MEDIUM

Key Information:

Vendor

Apitable

Status
Apitable
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111344?

APITable versions up to 1.14.0-beta are susceptible to an authorization bypass vulnerability that compromises user data confidentiality. Authenticated users can exploit this weakness by manipulating the nodeId parameter in requests, allowing them to access node descriptions from other spaces without proper permission checks. This oversight enables attackers to disclose sensitive information such as datasheet, folder, and form descriptions across different tenant environments, posing significant risks to data integrity and privacy.

Affected Version(s)

apitable 0 <= 1.14.0-beta

References

https://hackmd.io/@hieuPenguinnn/apitable-node-descriptio...
third-party-advisory
https://github.com/apitable/apitable/blob/v1.14.0-beta/ba...
technical-description
https://github.com/apitable/apitable
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.