Is CVE-2026-80207 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80207 being exploited in the wild.

How severe is CVE-2026-80207?

Medium severity, with a CVSS score of 5.3, published 27 August 2026.

Which products and versions are affected?

APITable through 1.13.0-beta.1.

Is there a fix for CVE-2026-80207?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-80207 attacked?

It is attacked over the network.

Am I affected by CVE-2026-80207?

Check whether you run APITable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80207: APITable authentication bypass in notification creation

CVE-2026-80207 · Severity: medium · CVSS 5.3 · Published 2026-08-27

APITable is a low-code platform for building collaborative applications. An unauthenticated attacker can bypass security controls to inject arbitrary notifications into any user's inbox by crafting HTTP requests to the internal notification API. These spoofed notifications can be made to appear as legitimate system messages, enabling social engineering attacks, phishing, or disruption of service.

Technologies: APITable. Vendors: APITable.

Quick answers

Is CVE-2026-80207 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80207 being exploited in the wild.
How severe is CVE-2026-80207?: Medium severity, with a CVSS score of 5.3, published 27 August 2026.
Which products and versions are affected?: APITable through 1.13.0-beta.1.
Is there a fix for CVE-2026-80207?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-80207 attacked?: It is attacked over the network.
Am I affected by CVE-2026-80207?: Check whether you run APITable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass in APITable's InternalNotifyController. The /api/v1/internal/notification/create endpoint is marked with requiredLogin = false in its annotation, and the ResourceInterceptor honors this flag by skipping session and API key validation before the handler executes. The nginx gateway does not restrict access to /api routes, making the endpoint reachable from the internet. An unauthenticated POST request allows an attacker to call batchCreateNotify() with arbitrary NotificationCreateRo objects, persisting notifications to the apitable_player_notification table for any user ID. By setting fromUserId to 0, notifications render as system messages. The extras field is stored and forwarded verbatim to the frontend, enabling content injection. Patches should enforce authentication on internal endpoints or restrict gateway access.

Affected products

APITable APITable through 1.13.0-beta.1

Timeline

2026-08-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.