CVE-2026-56773 describes a missing authorization vulnerability in teableio's teable product, specifically in the v2 REST API controller. The affected ORPC endpoints do not have @Permissions metadata, which results in the absence of authorization checks. Consequently, any authenticated user can perform unauthorized actions such as reading table schemas, creating tables, and modifying or deleting records across all bases and tables. The vulnerability is exploitable without user interaction and requires only low privileges (authenticated user). No official fix or patch has been announced as of the publication date.

An attacker with valid authentication credentials can bypass authorization controls to access and manipulate data across all tables and bases. This includes reading sensitive schema information, creating new tables, and modifying or deleting existing records. The vulnerability compromises data confidentiality, integrity, and availability within the affected teable instances.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the API endpoints to trusted users only and monitor for suspicious activity. Avoid granting unnecessary authentication credentials to untrusted users.