CVE-2026-56773 describes a missing authorization vulnerability in the teableio teable product's v2 REST API controller. The issue arises because the ORPC endpoints do not have @Permissions metadata, which means authorization checks are not enforced. As a result, any authenticated user with low privileges can perform unauthorized actions such as reading table schemas, creating tables, and modifying or deleting records across multiple bases and tables through endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords. The CVSS 4.0 score is 8.7, indicating a high severity vulnerability with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with any authenticated access can bypass authorization controls to read sensitive schema information, create new tables, and modify or delete existing records across all accessible bases and tables. This can lead to significant data exposure, unauthorized data manipulation, and potential disruption of database integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or workaround is provided, restrict access to the affected API endpoints to trusted users only and monitor for suspicious activity. Avoid granting unnecessary authentication credentials to untrusted users.