High severity · published Jun 26, 2026
CVE-2026-56773
Teable - Missing Authorization in v2 REST API
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
teable · teableio
before 2026-06-15T04-43-24Z.1912 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56773
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56773
github.com
https://github.com/teableio/teable/pull/3285
github.com
https://github.com/teableio/teable/releases/tag/release.2026-06-15T04-43-24Z.1912
www.vulncheck.com
https://www.vulncheck.com/advisories/teable-missing-authorization-in-v2-rest-api
More from teable
5.3
CVE-2026-56781
Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override
4.3
CVE-2026-9566
teableio teable Sign-up LoginPage.tsx cross site scripting
3.1
CVE-2026-112004
Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint