CVE-2026-86120 | BDVDB-2026-368539 Detail
apitableapitable
Description#
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been explicitly denied access to by exploiting the unhandled exception in the permission guard.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-636 Not Failing Securely ('Failing Open')
References#
- https://github.com/apitable/apitable/issues/1814
- https://github.com/apitable/apitable/blob/88b24ce9f359/packages/room-server/src/fusion/middleware/guard/node.permission.guard.ts
- https://github.com/apitable/apitable
- https://www.vulncheck.com/advisories/apitable-through-1.13.0-beta.1-fail-open-authorization-in-the-fusion-api-node-permission-guard
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.