CVE-2026-56773: Teable REST API Authorization Bypass

CVE-2026-56773 Overview

CVE-2026-56773 is a missing authorization vulnerability [CWE-862] in Teable, an open-source no-code database platform. The v2 REST API controller omits @Permissions metadata on ORPC endpoints, so the authorization guard never enforces role checks. Any authenticated user can invoke privileged endpoints such as GET /api/v2/tables/get and POST /api/v2/tables/updateRecords to read schemas, create tables, and modify or delete records across bases they should not access.

Critical Impact
Authenticated attackers can read, alter, and delete data across every base and table in a Teable instance, bypassing the platform's role-based access control model.

Affected Products

Teable (teableio/teable) versions prior to release release.2026-06-15T04-43-24Z.1912
Deployments exposing the v2 REST API (/api/v2/* ORPC endpoints)
Self-hosted Teable instances with multi-tenant or multi-user access

Discovery Timeline

2026-06-26 - CVE-2026-56773 published to NVD
2026-06-27 - Last updated in NVD database

Technical Details for CVE-2026-56773

Vulnerability Analysis

Teable exposes a v2 REST API implemented over ORPC (Object RPC) that reuses handlers from the internal service layer. Access control in Teable relies on a NestJS-style guard that reads @Permissions decorator metadata attached to each controller method. When metadata is absent, the guard treats the route as not requiring a specific permission and lets any authenticated request through.

The v2 controller registered dozens of ORPC endpoints without applying @Permissions decorators. As a result, endpoints that should require table-level or base-level permissions, such as reading a table schema or writing records, executed with only session authentication as a prerequisite. The guard did not fall back to a deny-by-default policy, so the missing annotation converted every protected action into a public authenticated action.

Root Cause

The root cause is a broken access control pattern [CWE-862]. Authorization enforcement depends on developers annotating each route with permission metadata, and the v2 controller was merged without those annotations. There is no server-side default that denies unannotated routes, so the check silently passes.

Attack Vector

An attacker needs a valid Teable account on the target instance. From that low-privileged session, the attacker sends HTTP requests to v2 ORPC endpoints referencing arbitrary tableId or baseId values. Requests to GET /api/v2/tables/get return schema information for tables the attacker does not own. Requests to POST /api/v2/tables/updateRecords or delete endpoints modify data in other users' bases. No user interaction on the victim's side is required. Refer to the VulnCheck Security Advisory for endpoint-level detail.

// No verified proof-of-concept code is published for CVE-2026-56773.
// See the linked advisory and pull request for technical details.

Detection Methods for CVE-2026-56773

Indicators of Compromise

Requests to /api/v2/tables/get, /api/v2/tables/updateRecords, or other /api/v2/* ORPC endpoints from user sessions that do not own the referenced tableId or baseId.
Unexpected schema reads, record edits, or table creation events attributed to low-privileged accounts in Teable audit logs.
Bursts of v2 API calls from a single session enumerating multiple tableId values.

Detection Strategies

Correlate Teable application logs with the ownership model: flag any v2 API call where the caller's user ID does not have an assigned role on the target base.
Alert on write endpoints (updateRecords, createTable, deleteRecord) invoked outside the standard web UI request pattern.
Baseline normal per-user API call volumes and detect deviations that indicate enumeration or bulk modification.

Monitoring Recommendations

Enable verbose request logging on the Teable reverse proxy to capture path, user_id, and target resource identifiers for every /api/v2/* call.
Forward Teable logs into a centralized SIEM or data lake and build detections around cross-tenant object access.
Review database change history for record modifications that lack a corresponding UI-driven workflow.

How to Mitigate CVE-2026-56773

Immediate Actions Required

Upgrade Teable to release release.2026-06-15T04-43-24Z.1912 or later, which adds the missing @Permissions metadata to the v2 controller.
Restrict access to the Teable instance to trusted users while patching, and rotate API tokens issued to low-privileged accounts.
Audit recent activity on /api/v2/* endpoints to identify unauthorized reads or writes performed before the fix was applied.

Patch Information

The fix is delivered in GitHub Pull Request #3285 and shipped in the Teable release release.2026-06-15T04-43-24Z.1912. The change applies @Permissions decorators to the affected ORPC endpoints so the authorization guard enforces role checks on every v2 route.

Workarounds

Block external access to /api/v2/* routes at the reverse proxy or ingress controller until the patched release is deployed.
Limit Teable user provisioning to trusted individuals and disable self-service signup on affected instances.
Segment sensitive bases into separate Teable deployments so a compromised session cannot reach unrelated data.

bash

# Example nginx snippet to block v2 API routes pending upgrade
location /api/v2/ {
    return 403;
}