# CVE-2026-80208: APITable authentication bypass in InternalUserController

Source: https://junglewise.ai/threats/cve-2026-80208-apitable-authentication-bypass-in-internalusercontroller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80208 · Severity: high · CVSS 8.2 · Published 2026-08-27

APITable is an open-source low-code platform for building collaborative applications. Two administrative endpoints in the InternalUserController are incorrectly marked as not requiring authentication, allowing unauthenticated attackers to enumerate user accounts and permanently delete them by clearing credentials and canceling account recovery options. This bypasses the 30-day deletion reversal window and results in irreversible account destruction.

Technologies: [APITable](https://junglewise.ai/threats/technologies/apitable). Vendors: [APITable](https://junglewise.ai/threats/vendors/apitable).

## Quick answers

**Is CVE-2026-80208 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80208 being exploited in the wild.

**How severe is CVE-2026-80208?** High severity, with a CVSS score of 8.2, published 27 August 2026.

**Which products and versions are affected?** APITable through 1.13.0-beta.1.

**Is there a fix for CVE-2026-80208?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-80208 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-80208?** Check whether you run APITable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in the InternalUserController class, where the getUserHistories and closePausedUserAccount endpoints are annotated with requiredLogin = false. The ResourceInterceptor honors this annotation and skips session and API key validation before these endpoints are reached. Since the nginx gateway proxies all /api requests to the backend, unauthenticated clients can reach /api/v1/internal/getUserHistories to enumerate accounts in the 30-day cooling-off period following deletion, then POST to /api/v1/internal/users/{userId}/close to permanently close each account. The close operation irreversibly clears email, phone, and nickname; cancels subscriptions; removes memberships; and deletes OAuth bindings, bypassing the account recovery mechanism. The attack requires only network access to the gateway and no authentication.

## Affected products

- APITable APITable through 1.13.0-beta.1

## Timeline

- 2026-08-27: disclosed

## References

- [https://github.com/apitable/apitable](https://github.com/apitable/apitable)
- [https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/internal/controller/InternalUserController.java](https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/internal/controller/InternalUserController.java)

## Related threats

- [APITable NodePermissionGuard authorization bypass](https://junglewise.ai/threats/cve-2026-86120-apitable-nodepermissionguard-authorization-bypass)
- [APITable authentication bypass in organization search endpoint](https://junglewise.ai/threats/cve-2026-84485-apitable-authentication-bypass-in-organization-search-endpoint)
- [APITable authentication bypass in notification creation](https://junglewise.ai/threats/cve-2026-80207-apitable-authentication-bypass-in-notification-creation)