Executive brief
APITable is an open-source low-code platform for building collaborative applications. Two administrative endpoints in the InternalUserController are incorrectly marked as not requiring authentication, allowing unauthenticated attackers to enumerate user accounts and permanently delete them by clearing credentials and canceling account recovery options. This bypasses the 30-day deletion reversal window and results in irreversible account destruction.
Technical details
The vulnerability is an authentication bypass in the InternalUserController class, where the getUserHistories and closePausedUserAccount endpoints are annotated with requiredLogin = false. The ResourceInterceptor honors this annotation and skips session and API key validation before these endpoints are reached. Since the nginx gateway proxies all /api requests to the backend, unauthenticated clients can reach /api/v1/internal/getUserHistories to enumerate accounts in the 30-day cooling-off period following deletion, then POST to /api/v1/internal/users/{userId}/close to permanently close each account. The close operation irreversibly clears email, phone, and nickname; cancels subscriptions; removes memberships; and deletes OAuth bindings, bypassing the account recovery mechanism. The attack requires only network access to the gateway and no authentication.
Affected products
- APITable APITable through 1.13.0-beta.1
Timeline
- 2026-08-27: disclosed