Approved changes feed: RSS · Atom
cpe:2.3:a:teableio:teable:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Teableio (f610a18f-e27d-52fe-a577-31dba637a7f1) |
|---|---|
| Product | Teable (99fdcf2a-bffb-5b73-8d3f-c32690e8c1ba) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-112004 |
vulnerable | 2026-11-03 10:16:28.577474 |
Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint
LOW (3.1)
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.
Published: 2026-10-18T11:38:28.495Z
Updated: 2026-10-20T15:09:09.557Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-56781 |
vulnerable | 2026-07-29 01:00:29.301581 |
Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override
MEDIUM (5.3)
Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supplying arbitrary field IDs in the projection parameter of the share view records endpoint. Attackers can enumerate hidden field IDs from share metadata and specify them in projection parameters to read field values that are intended to be restricted from public view.
Published: 2026-06-29T17:15:49.423Z
Updated: 2026-11-08T14:06:23.415Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-56773 |
vulnerable | 2026-07-29 01:00:29.295816 |
Teable - Missing Authorization in v2 REST API
HIGH (8.8)
Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.
Published: 2026-06-26T14:38:32.177Z
Updated: 2026-11-08T14:06:20.523Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.