Authorization Bypass in Teable's v2 REST API Controller

CVE-2026-56773

What is CVE-2026-56773?

The v2 REST API controller of Teable is susceptible to an authorization bypass due to missing @Permissions metadata on ORPC endpoints. This oversight allows any authenticated user to access functions that should be restricted, including reading table schemas and executing CRUD operations such as creating, modifying, or deleting records. Critical endpoints, such as GET /api/v2/tables/get and POST /api/v2/tables/updateRecords, can be exploited to forge unauthorized data alterations across various databases and tables.

References