CVE-2026-56773

Name of the Vulnerable Software and Affected Versions Teable (affected versions not specified)

Description The v2 REST API controller lacks @Permissions metadata on ORPC endpoints, which enables authenticated users to bypass authorization checks. This allows unauthorized reading of table schemas, creation of tables, and the modification or deletion of records across various bases and tables. Affected API endpoints include 'GET /api/v2/tables/get' and 'POST /api/v2/tables/updateRecords'.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.