CVE-2026-80207

Name of the Vulnerable Software and Affected Versions APITable versions prior to 1.13.0-beta.1

Description The create handler of the InternalNotifyController is incorrectly configured with requiredLogin = false. The ResourceInterceptor respects this setting and allows requests to proceed without session or API key validation. Since the bundled nginx gateway proxies all /api requests to the backend, the endpoint 'POST /api/v1/internal/notification/create' is accessible to unauthenticated clients. This allows an attacker to create arbitrary notifications for any user ID. By setting the fromUserId variable to 0, the notification is attributed to the system sender and appears as a legitimate system message in the victim's inbox. The content within the extras body is stored verbatim and sent to the frontend.

Recommendations Update APITable to a version later than 1.13.0-beta.1. As a temporary mitigation, restrict access to the 'POST /api/v1/internal/notification/create' endpoint at the gateway level.