Missing Authentication in APITable Internal Notification Handler

CVE-2026-80207

What is CVE-2026-80207?

APITable versions up to 1.13.0-beta.1 have a critical vulnerability where the create handler of the InternalNotifyController is incorrectly annotated with 'requiredLogin = false'. This allows unauthenticated clients to access the notification creation endpoint, which is mistakenly reachable without validation of any session or API key. Consequently, attackers can persist arbitrary notifications tied to any user ID, exploiting the system to send crafted messages appearing as legitimate notifications from the system sender. This flaw can compromise the integrity of user notifications, posing significant security risks.

References