CVE-2026-84485: APITable Authentication Bypass Vulnerability

CVE-2026-84485 Overview

CVE-2026-84485 affects APITable through version 1.13.0-beta.1. The application exposes the internal organization loadOrSearch endpoint without authentication. Unauthenticated attackers can retrieve member names, email addresses, and complete team hierarchy from any workspace. Attackers query the endpoint using space identifiers obtained from shared links or public templates. This allows enumeration of the entire member directory of any APITable workspace. The vulnerability is classified as Missing Authentication for a Critical Function [CWE-306].

Critical Impact

Unauthenticated remote attackers can enumerate the full member directory, including email addresses and team structure, of any APITable workspace reachable over the network.

Affected Products

• APITable through 1.13.0-beta.1
• APITable backend-server Internal Organization Controller
• Self-hosted APITable deployments exposed to untrusted networks

Discovery Timeline

• 2026-09-02 - CVE-2026-84485 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84485

Vulnerability Analysis

APITable is an open-source collaborative workspace platform. The backend-server component exposes an internal endpoint intended for authenticated inter-service calls at InternalOrganizationController. The endpoint accepts a space identifier and returns member and team data used to populate organizational selectors. Because the endpoint lives under the /internal/ path prefix, it is not intended to be reachable by unauthenticated external clients.

Attackers who obtain a space identifier from a public share link, public template, or exported asset can call the loadOrSearch endpoint directly. The response discloses employee names, email addresses, and the full team hierarchy. This data supports targeted phishing, credential-stuffing campaigns, and reconnaissance against downstream systems.

Root Cause

The ResourceInterceptor and LoginContext components do not enforce authentication on routes under the internal controller path used by InternalOrganizationController. As a result, the loadOrSearch handler executes without validating a session or service-to-service credential. See the InternalOrganizationController source and the ResourceInterceptor source for the code paths involved.

Attack Vector

The attack is fully remote and requires no authentication or user interaction. An attacker collects a space identifier from any publicly reachable APITable share link or template. The attacker then issues an HTTP request to the internal loadOrSearch endpoint with that space identifier. The server returns member and team data for the corresponding workspace. No verified public exploit code is available. See the VulnCheck advisory for additional context.

Detection Methods for CVE-2026-84485

Indicators of Compromise

• Unauthenticated HTTP requests to paths matching /internal/**/loadOrSearch on APITable backend-server instances.
• Bursts of loadOrSearch requests iterating through multiple space identifiers from a single source.
• Access log entries for internal endpoints originating from public network ranges rather than internal service IPs.

Detection Strategies

• Alert on any external source reaching URIs under the /internal/ prefix of the APITable backend.
• Baseline expected callers of InternalOrganizationController and flag deviations by source IP or user agent.
• Correlate outbound share-link generation with subsequent unauthenticated hits on internal endpoints referencing the same space identifiers.

Monitoring Recommendations

• Ingest APITable backend-server access logs into a centralized logging or SIEM platform for retention and search.
• Monitor reverse proxy or ingress logs for HTTP 200 responses on internal paths without an associated authenticated session cookie.
• Track anomalous email-address enumeration patterns downstream, such as sudden increases in phishing targeting APITable users.

How to Mitigate CVE-2026-84485

Immediate Actions Required

• Block external access to any URI under the /internal/ path of the APITable backend-server at the reverse proxy, load balancer, or WAF layer.
• Restrict network exposure of the backend-server so only trusted internal services can reach /internal/ routes.
• Rotate or invalidate publicly shared space links and public templates that could disclose space identifiers to attackers.

Patch Information

At the time of publication, no fixed release beyond 1.13.0-beta.1 is referenced in the NVD entry. Monitor the APITable GitHub repository and the VulnCheck advisory for a vendor-supplied fix and upgrade guidance.

Workarounds

• Deploy network ACLs so /internal/ endpoints are reachable only from application-tier service accounts.
• Add an authentication requirement in the reverse proxy for internal paths until an upstream patch is available.
• Audit and remove public share links and templates that are not strictly required for business operations.

# Example NGINX configuration blocking external access to internal endpoints
location /internal/ {
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    deny all;
    proxy_pass http://apitable-backend;
}