Description
APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips space membership and node permission checks, to disclose cross-tenant datasheet, folder, and form descriptions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| apitable | apitable | ≤ 1.14.0-beta | — |
Advisories 1
- NCSC-2026-0491 Meerdere kwetsbaarheden verholpen in Citrix Secure Access Client, NetScaler ADC, NetScaler Gateway en NetScaler Console. NCSC-NL (Netherlands) · Nov 12, 2026
References
- https://hackmd.io/@hieuPenguinnn/apitable-node-description-cross-space-idor third-party-advisory
- https://github.com/apitable/apitable/blob/v1.14.0-beta/backend-server/application/src/main/java/com/apitable/workspace/controller/NodeController.java#L1043-L1057 technical-description
- https://github.com/apitable/apitable product
- VulnCheck Advisory: APITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description third-party-advisory