# CVE-2026-111344: APITable authorization bypass in node description endpoint

Source: https://junglewise.ai/threats/cve-2026-111344-apitable-through-1-14-0-beta-contains-an-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111344 · Severity: medium · CVSS 4.3 · Published 2026-10-15

APITable is a collaborative database and workspace platform. An authorization flaw allows authenticated users to bypass access controls and view descriptions of datasheets, folders, and forms from other workspaces by directly requesting specific node IDs. This enables attackers with valid credentials to access sensitive information they should not see.

## Quick answers

**Is CVE-2026-111344 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111344 being exploited in the wild.

**How severe is CVE-2026-111344?** Medium severity, with a CVSS score of 4.3, published 15 October 2026.

**Which products and versions are affected?** APITable through 1.14.0-beta.

**Is there a fix for CVE-2026-111344?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111344 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111344?** Check whether you run APITable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The GET /node/{nodeId}/description endpoint in APITable fails to properly validate space membership and node permissions when a user-controlled nodeId is supplied. Authenticated attackers can enumerate or directly request nodeIds to disclose datasheet, folder, and form descriptions from other tenants without proper authorization checks.

## Affected products

- APITable through 1.14.0-beta

## Timeline

- 2026-10-15: disclosed

## References

- [https://github.com/apitable/apitable](https://github.com/apitable/apitable)
- [https://github.com/apitable/apitable/blob/v1.14.0-beta/backend-server/application/src/main/java/com/apitable/workspace/controller/NodeController.java](https://github.com/apitable/apitable/blob/v1.14.0-beta/backend-server/application/src/main/java/com/apitable/workspace/controller/NodeController.java)