Threat database

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.

Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supplying arbitrary field IDs in the projection parameter of the share view records endpoint. Attackers can enumerate hidden field IDs from share metadata and specify them in projection parameters to read field values that are intended to be restricted from public view.

Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.

CVE-2026-9566 is a cross-site scripting (XSS) vulnerability in teableio teable versions up to 1.9.x. It affects the login redirect functionality in the Sign-up component, specifically in the file LoginPage.tsx. The vulnerability arises from improper validation of the redirect parameter, allowing remote attackers to inject malicious scripts. The issue has been fixed in the develop branch by validating redirect paths to block javascript:, data:, and cross-origin redirects. The CVSS 4.0 score is 5.3, indicating a medium severity level.