Is CVE-2026-56781 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56781 being exploited in the wild.

How severe is CVE-2026-56781?

Medium severity, with a CVSS score of 5.3, published 29 June 2026.

Which products and versions are affected?

Teableio Teable Before 2026-06-15T04-43-24Z.1912.

Is there a fix for CVE-2026-56781?

A patch was published on 2026-06-15: Fix included in release 2026-06-15T04-43-24Z.1912 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56781 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-56781?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56781: Teable improper access control in shared view records endpoint

CVE-2026-56781 · Severity: medium · CVSS 5.3 · Published 2026-06-29

Teable, an open-source no-code database platform, contains a security flaw in how it handles shared views. An unauthorized person with a public share link can bypass privacy settings to view data in 'hidden' columns that the owner intended to keep private. This could lead to the exposure of sensitive information, such as internal notes or personal data, that was supposed to be restricted from public view.

Quick answers

Is CVE-2026-56781 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56781 being exploited in the wild.
How severe is CVE-2026-56781?: Medium severity, with a CVSS score of 5.3, published 29 June 2026.
Which products and versions are affected?: Teableio Teable Before 2026-06-15T04-43-24Z.1912.
Is there a fix for CVE-2026-56781?: A patch was published on 2026-06-15: Fix included in release 2026-06-15T04-43-24Z.1912 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56781 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-56781?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability (CWE-639) exists in the Teable NestJS backend within the share view records endpoint. While the application defaults to a projection of non-hidden fields, the 'projection' query parameter in the GET /api/share/:shareId/view/records endpoint allows a client to override this set. Because the snapshot read path fails to intersect the user-supplied projection with the allowed (visible) field set, unauthenticated attackers can request hidden field IDs. These IDs are easily discoverable via the view.columnMeta field in the anonymous share metadata response. The vulnerability was patched by ensuring the backend restricts supplied projections to the visible field set.

Affected products

Teableio Teable Before 2026-06-15T04-43-24Z.1912

Timeline

2026-06-12: disclosed: Vulnerability reported to vendor via GitHub issue
2026-06-15: patched: Fix included in release 2026-06-15T04-43-24Z.1912
2026-06-29: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.