Executive brief
Teable, an open-source no-code database platform, contains a security flaw in how it handles shared views. An unauthorized person with a public share link can bypass privacy settings to view data in 'hidden' columns that the owner intended to keep private. This could lead to the exposure of sensitive information, such as internal notes or personal data, that was supposed to be restricted from public view.
Technical details
An improper access control vulnerability (CWE-639) exists in the Teable NestJS backend within the share view records endpoint. While the application defaults to a projection of non-hidden fields, the 'projection' query parameter in the GET /api/share/:shareId/view/records endpoint allows a client to override this set. Because the snapshot read path fails to intersect the user-supplied projection with the allowed (visible) field set, unauthenticated attackers can request hidden field IDs. These IDs are easily discoverable via the view.columnMeta field in the anonymous share metadata response. The vulnerability was patched by ensuring the backend restricts supplied projections to the visible field set.
Affected products
- Teableio Teable Before 2026-06-15T04-43-24Z.1912
Timeline
- 2026-06-12: disclosed: Vulnerability reported to vendor via GitHub issue
- 2026-06-15: patched: Fix included in release 2026-06-15T04-43-24Z.1912
- 2026-06-29: advisory: CVE published to NVD