Executive brief
Teable, an open-source no-code database platform, contains a security flaw in its version 2 application interface (API). This vulnerability allows any logged-in user to bypass security restrictions and access, modify, or delete data across the entire platform, regardless of their actual permissions. This could lead to the unauthorized exposure of sensitive table schemas or the loss and corruption of business data.
Technical details
A missing authorization vulnerability (CWE-862) exists in Teable's v2 REST API controller. The root cause is the absence of @Permissions metadata on ORPC endpoints, which prevents the system from enforcing intended access control policies. An authenticated attacker can exploit this by sending crafted requests to endpoints such as GET /api/v2/tables/get or POST /api/v2/tables/updateRecords. Successful exploitation allows the attacker to read table schemas, create new tables, and modify or delete records across any base or table in the instance. The issue is addressed in the release version 2026-06-15T04-43-24Z.1912.
Affected products
- teableio Teable < 2026-06-15T04-43-24Z.1912
Timeline
- 2026-06-04: patched: Pull request submitted to guard v2 table endpoints with permissions.
- 2026-06-16: patched: Release version 2026-06-15T04-43-24Z.1912 published.
- 2026-06-26: disclosed: CVE-2026-56773 published.