Medium severity · published Jun 29, 2026
CVE-2026-56781
Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supplying arbitrary field IDs in the projection parameter of the share view records endpoint. Attackers can enumerate hidden field IDs from share metadata and specify them in projection parameters to read field values that are intended to be restricted from public view.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
teable · teableio
before 2026-06-15T04-43-24Z.1912 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56781
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56781
github.com
https://github.com/teableio/teable/issues/3335
github.com
https://github.com/teableio/teable/pull/3353
github.com
https://github.com/teableio/teable/releases/tag/release.2026-06-15T04-43-24Z.1912
www.vulncheck.com
https://www.vulncheck.com/advisories/teable-unauthenticated-hidden-field-disclosure-via-projection-parameter-override
More from teable
8.8
CVE-2026-56773
Teable - Missing Authorization in v2 REST API
4.3
CVE-2026-9566
teableio teable Sign-up LoginPage.tsx cross site scripting
3.1
CVE-2026-112004
Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint