Executive brief
APITable, a low-code collaborative app platform, exposes an internal organization member search endpoint without requiring authentication. Attackers can retrieve complete member directories including names, email addresses, and team hierarchies from any workspace by using space identifiers from publicly shared content. This allows unauthorized reconnaissance and collection of sensitive organizational information.
Technical details
The vulnerability is an authentication bypass in the `/internal/organization/loadOrSearch` endpoint within the InternalOrganizationController. The endpoint fails to enforce authentication checks before returning organization member details. Attackers can exploit this by supplying space identifiers (obtained from shared links or public templates) without valid credentials. No special privileges or user interaction are required; the endpoint is directly network-accessible. An attacker can enumerate all members across an organization, extracting names, emails, and team structures. The vulnerability affects APITable versions up to 1.13.0-beta.1 and requires a patch to add proper authentication validation.
Affected products
- APITable APITable through 1.13.0-beta.1
Timeline
- 2026-09-02: disclosed