CVE-2026-56773: Teable missing authorization in v2 REST API controller

CVE-2026-56773 · Severity: high · CVSS 8.8 · Published 2026-06-26

Teable, an open-source no-code database platform, contains a security flaw in its version 2 application interface (API). This vulnerability allows any logged-in user to bypass security restrictions and access, modify, or delete data across the entire platform, regardless of their actual permissions. This could lead to the unauthorized exposure of sensitive table schemas or the loss and corruption of business data.

Technologies: Teable. Vendors: Teable.

Quick answers

Is CVE-2026-56773 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56773 being exploited in the wild.
How severe is CVE-2026-56773?
High severity, with a CVSS score of 8.8, published 26 June 2026.
Which products and versions are affected?
Teable < 2026-06-15T04-43-24Z.1912.
Is there a fix for CVE-2026-56773?
A patch was published on 2026-06-04: Pull request submitted to guard v2 table endpoints with permissions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56773 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56773?
Check whether you run Teable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in Teable's v2 REST API controller. The root cause is the absence of @Permissions metadata on ORPC endpoints, which prevents the system from enforcing intended access control policies. An authenticated attacker can exploit this by sending crafted requests to endpoints such as GET /api/v2/tables/get or POST /api/v2/tables/updateRecords. Successful exploitation allows the attacker to read table schemas, create new tables, and modify or delete records across any base or table in the instance. The issue is addressed in the release version 2026-06-15T04-43-24Z.1912.

Affected products

  • teableio Teable < 2026-06-15T04-43-24Z.1912

Timeline

  • 2026-06-04: patched: Pull request submitted to guard v2 table endpoints with permissions.
  • 2026-06-16: patched: Release version 2026-06-15T04-43-24Z.1912 published.
  • 2026-06-26: disclosed: CVE-2026-56773 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.