CVE-2026-80208

Name of the Vulnerable Software and Affected Versions APITable versions prior to 1.13.0-beta.1

Description An authentication bypass exists in the InternalUserController where the getUserHistories() and closePausedUserAccount() functions are incorrectly annotated with requiredLogin = false. The ResourceInterceptor respects this annotation and allows requests to proceed before validating sessions or API keys. Because the bundled nginx gateway proxies all /api requests to the backend, these endpoints are accessible to unauthenticated clients. An attacker can use the /api/v1/internal/getUserHistories endpoint to identify accounts in the 30-day cooling-off period following a deletion request and subsequently use the /api/v1/internal/users/{userId}/close endpoint, utilizing the userId variable, to permanently close those accounts. This process removes the email address, phone number, nickname, space subscriptions, space memberships, and OAuth bindings, preventing account recovery.

Recommendations Update to version 1.13.0-beta.1 or later. Restrict access to the /api/v1/internal/getUserHistories and /api/v1/internal/users/{userId}/close endpoints to prevent unauthenticated access.