CVE-2026-56781: Teable Information Disclosure Vulnerability

CVE-2026-56781 Overview

CVE-2026-56781 is an improper access control vulnerability in Teable, an open-source no-code database platform. Versions prior to release 2026-06-15T04-43-24Z.1912 fail to validate field visibility when processing the projection parameter on the share view records endpoint. Anonymous attackers can enumerate hidden field identifiers from share metadata and specify them in projection parameters to read field values intended to be restricted from public view. The flaw is tracked as CWE-639: Authorization Bypass Through User-Controlled Key and requires no authentication, no user interaction, and no privileges to exploit over the network.

Critical Impact
Unauthenticated remote attackers can retrieve confidential hidden field data from any publicly shared Teable view by supplying arbitrary field IDs in the projection query parameter.

Affected Products

Teable self-hosted deployments prior to release 2026-06-15T04-43-24Z.1912
Teable share view records API endpoint
Any Teable base containing shared views with hidden fields

Discovery Timeline

2026-06-29 - CVE-2026-56781 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-56781

Vulnerability Analysis

Teable allows base owners to publish read-only shared views of tables while hiding specific columns from public consumers. The share view records endpoint accepts a projection query parameter that lets clients request a subset of columns. The endpoint enforces which records are returned but does not enforce which fields the caller is permitted to include in the projection. When a hidden field ID is supplied, the server returns its values in the response payload.

The vulnerability is categorized as an authorization bypass through user-controlled key [CWE-639]. Confidentiality of shared table data is directly impacted, while integrity and availability are not affected. Because the endpoint is exposed to anonymous share consumers, exploitation requires only a share link.

Root Cause

The root cause is missing server-side validation between the fields marked hidden in a share view configuration and the field IDs accepted in the projection parameter. The projection logic trusts client input and does not intersect the requested field set with the share view's allowed columns before dispatching the database query.

Attack Vector

An attacker first requests the share view's metadata endpoint, which exposes field identifiers for all columns in the underlying table, including those marked hidden. The attacker then issues a records request to the share endpoint and appends the hidden field IDs to the projection parameter. The server returns the hidden field values in the JSON response. No account, session, or CSRF token is required. Refer to the VulnCheck Security Advisory and GitHub Issue #3335 for the reported request pattern.

Detection Methods for CVE-2026-56781

Indicators of Compromise

Anonymous HTTP requests to Teable share view records endpoints containing a projection parameter with multiple field IDs
Access log entries where the same share token is queried repeatedly with varying projection values, indicating field enumeration
Requests to share metadata endpoints followed within seconds by records requests referencing previously undisclosed field IDs

Detection Strategies

Compare projection field IDs in share endpoint requests against the share view's configured visible field set and alert on mismatches
Inspect Teable application logs for share/*/view/*/records requests originating from unauthenticated sessions with non-default projections
Deploy a web application firewall rule that flags share endpoint requests carrying more field IDs than the share view publicly advertises

Monitoring Recommendations

Baseline normal share endpoint traffic and alert on volumetric spikes in anonymous requests against a single share token
Track outbound response sizes from share endpoints; larger-than-expected payloads may indicate hidden field disclosure
Retain Teable reverse proxy access logs with full query strings to support post-incident analysis of exploitation attempts

How to Mitigate CVE-2026-56781

Immediate Actions Required

Upgrade Teable to release 2026-06-15T04-43-24Z.1912 or later, which contains the fix from GitHub Pull Request #3353
Audit existing shared views and disable or rotate share links for any view containing sensitive hidden fields until patching is complete
Review recent access logs for anomalous projection parameter usage on share endpoints and assess data exposure scope

Patch Information

The upstream fix is available in the Teable release tagged release.2026-06-15T04-43-24Z.1912. The patch adds server-side validation that restricts the projection parameter to fields explicitly visible in the share view configuration. Self-hosted operators should pull the updated container image or source and redeploy.

Workarounds

Remove sensitive columns from shared tables entirely rather than relying on field hiding until the patch is applied
Restrict access to the Teable share endpoints via an upstream reverse proxy that filters or strips the projection query parameter
Place shared Teable instances behind an authentication gateway to prevent anonymous exploitation while the patch is deployed

bash

# Example nginx rule to strip the projection parameter from share endpoints
location ~ ^/api/share/[^/]+/view/[^/]+/records {
    if ($arg_projection) {
        return 400;
    }
    proxy_pass http://teable_backend;
}