Threats affecting pkg:github/teable

Teable versions prior to 2026-10-12T12-45-53Z.3331 contain an authorization bypass vulnerability. Authenticated users can rename folders in bases where they do not have membership by supplying a foreign folderId to the PATCH /api/base/:baseId/node/folder/:folderId endpoint. The endpoint incorrectly validates permissions only against the baseId in the URL, allowing unauthorized folder renaming. This issue is fixed in version 2026-10-12T12-45-53Z.3331.

Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supplying arbitrary field IDs in the projection parameter of the share view records endpoint. Attackers can enumerate hidden field IDs from share metadata and specify them in projection parameters to read field values that are intended to be restricted from public view.

Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.