CVE-2026-86120: APITable Authorization Bypass Vulnerability

CVE-2026-86120 Overview

CVE-2026-86120 is an incorrect authorization vulnerability in APITable through version 1.13.0-beta.1. The flaw resides in the NodePermissionGuard component of the Fusion API middleware. When permission lookup operations throw exceptions, the guard fails open rather than denying access. Attackers holding valid Fusion API tokens can write attachments to private datasheets they were explicitly denied access to. The issue is tracked under CWE-636: Not Failing Securely (Fail Open).

Critical Impact

Authenticated users with any valid Fusion API token can bypass node-level access controls and write attachments to restricted datasheets, undermining tenant data segregation.

Affected Products

• APITable through 1.13.0-beta.1
• APITable Fusion API room-server component
• Deployments using node.permission.guard.ts in the Fusion middleware

Discovery Timeline

• 2026-09-05 - CVE-2026-86120 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86120

Vulnerability Analysis

APITable exposes a Fusion API secured by NodePermissionGuard, a NestJS guard evaluated before write operations against datasheet nodes. The guard is responsible for confirming that the authenticated token holder has the required node-level role before attachments or records are modified.

The guard implementation does not treat exceptions raised during permission resolution as denials. When the underlying permission lookup throws, control returns without a negative decision, and the request proceeds to the write handler. This is a textbook fail-open authorization pattern classified under CWE-636.

The practical consequence is limited to integrity: an attacker can add attachments to private datasheets. Confidentiality of existing data and availability of the service are not directly affected, which aligns with the medium severity rating.

Root Cause

The root cause is missing exception handling inside packages/room-server/src/fusion/middleware/guard/node.permission.guard.ts. The guard's permission evaluation logic does not wrap lookup calls in a try/catch that returns false on error. Any thrown exception, whether triggered by a missing binding, malformed identifier, or transient dependency failure, results in the guard not returning an explicit deny.

Attack Vector

Exploitation requires network access to the Fusion API and a valid API token, which any low-privilege tenant user can obtain. The attacker issues an attachment write request targeting a datasheetId they do not have permission to modify. By crafting the request in a way that forces the permission lookup to throw, the attacker triggers the fail-open path in NodePermissionGuard. The write is then accepted by the downstream handler. No user interaction is required, and the attack complexity is low.

See the VulnCheck Advisory on APITable Fusion API fail-open authorization and GitHub Issue #1814 for reproduction context. The vulnerable source is available in the APITable node.permission.guard.ts source.

Detection Methods for CVE-2026-86120

Indicators of Compromise

• Fusion API attachment write requests (POST /fusion/v1/datasheets/{datasheetId}/attachments) from tokens that lack an explicit grant on the target datasheetId.
• Application logs showing exceptions inside NodePermissionGuard immediately followed by a 2xx response for the same request.
• Newly created attachment records on private datasheets with createdBy identifiers not present in the datasheet's role assignments.

Detection Strategies

• Correlate API gateway access logs with APITable role assignments to flag write operations against nodes the caller cannot list.
• Alert on any NodePermissionGuard stack traces in room-server logs paired with successful downstream handler execution.
• Baseline per-token write volume against distinct datasheetId values and flag sudden expansion of the target set.

Monitoring Recommendations

• Enable verbose logging in the Fusion middleware so exceptions inside guards produce structured events suitable for SIEM ingestion.
• Forward room-server and reverse proxy logs to a centralized data lake and retain them for a minimum of 90 days for retrospective hunting.
• Track outbound attachment storage writes (for example, S3 PutObject calls) initiated by APITable service accounts and reconcile them against authorized datasheet activity.

How to Mitigate CVE-2026-86120

Immediate Actions Required

• Inventory all APITable deployments and identify instances running 1.13.0-beta.1 or earlier.
• Rotate all Fusion API tokens and revoke tokens issued to untrusted or low-trust users until a patched build is deployed.
• Restrict network access to the Fusion API to trusted networks or authenticated reverse proxies while remediation is in progress.
• Audit recent attachment write activity on private datasheets and remove unauthorized objects.

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry. Track the upstream APITable project repository and GitHub Issue #1814 for a corrected NodePermissionGuard implementation that wraps permission resolution in explicit exception handling and denies by default. Consult the VulnCheck advisory for the authoritative remediation guidance.

Workarounds

• Apply a local patch to node.permission.guard.ts that wraps permission lookups in try/catch and returns false when any exception is raised.
• Place an upstream reverse proxy or API gateway policy that enforces datasheet-scoped authorization independently of the application guard.
• Disable the Fusion API entirely for tenants that do not require programmatic attachment uploads.
• Reduce the blast radius by limiting the scope of issued API tokens to specific spaces and datasheets rather than tenant-wide access.

# Example reverse proxy rule (NGINX) restricting Fusion attachment writes
# to an internal allowlist while a fixed release is not yet available.
location ~ ^/fusion/v[0-9]+/datasheets/[^/]+/attachments {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://apitable_upstream;
}