Executive brief
APITable is a low-code platform for building collaborative applications. An unauthenticated attacker can bypass security controls to inject arbitrary notifications into any user's inbox by crafting HTTP requests to the internal notification API. These spoofed notifications can be made to appear as legitimate system messages, enabling social engineering attacks, phishing, or disruption of service.
Technical details
The vulnerability is an authentication bypass in APITable's InternalNotifyController. The /api/v1/internal/notification/create endpoint is marked with requiredLogin = false in its annotation, and the ResourceInterceptor honors this flag by skipping session and API key validation before the handler executes. The nginx gateway does not restrict access to /api routes, making the endpoint reachable from the internet. An unauthenticated POST request allows an attacker to call batchCreateNotify() with arbitrary NotificationCreateRo objects, persisting notifications to the apitable_player_notification table for any user ID. By setting fromUserId to 0, notifications render as system messages. The extras field is stored and forwarded verbatim to the frontend, enabling content injection. Patches should enforce authentication on internal endpoints or restrict gateway access.
Affected products
- APITable APITable through 1.13.0-beta.1
Timeline
- 2026-08-27: disclosed