CVE-2026-56773: Teable v2 REST API Authorization Bypass – HIGH Severity

Technical summary

CVE-2026-56773 is an authorization bypass in Teable's v2 REST API controller. ORPC (Object-Relational Procedure Call) endpoints lack @Permissions decorators, causing authorization checks to be skipped during request handling. Affected endpoints include GET /api/v2/tables/get (schema disclosure) and POST /api/v2/tables/updateRecords (data manipulation). The flaw affects any authenticated user; no additional privileges or user interaction is required. The vulnerability is rooted in CWE-862 (Missing Authorization), a common architectural failure where access control logic is omitted rather than misconfigured.

Business impact

This vulnerability creates significant insider and lateral-movement risk in organizations using Teable for data management. Authenticated users—including contractors, employees with minimal roles, or accounts compromised via phishing—can extract sensitive data schemas and business records without detection, modify critical datasets, or delete information to disrupt operations. In multi-tenant or collaborative environments, a single compromised account grants cross-base access, amplifying exposure. Recovery from unauthorized data modification may require restores from backups, consuming incident response resources and potentially affecting SLA commitments.

Affected systems

Teable's v2 REST API is affected. The scope of affected product versions has not been disclosed in available advisories. Verify the version deployed in your environment against the vendor's security advisory to confirm applicability. Instances exposing the v2 REST API—whether self-hosted or cloud-based—are at risk if proper network segmentation and authentication policies are not in place.

Exploitability

Exploitability is straightforward. An attacker requires only valid credentials to any Teable instance; no special privileges, exploits, or network access beyond API connectivity are needed. The attack surface is the entire authenticated API surface. CVSS score of 8.8 (HIGH) reflects low attack complexity, no user interaction requirement, and high impact across confidentiality, integrity, and availability. This is not listed in CISA's Known Exploited Vulnerabilities catalog as of the latest update, but the simplicity of the attack—sending HTTP requests with valid auth tokens—makes it a high priority for threat actors and insider threats.

Remediation

Apply the vendor's security patch immediately upon release. Teable should issue an update adding @Permissions metadata to all ORPC endpoints and restoring authorization checks in the v2 controller. Until patching is possible, implement compensating controls: restrict API access via network policies, enforce strong authentication and role-based access controls (RBAC) at the application level, audit all API activity for suspicious data access patterns, and isolate Teable instances handling sensitive data from untrusted networks.

Patch guidance

Monitor Teable's official security advisories and release notes for version updates addressing this vulnerability. When available, apply the patch to all instances—development, staging, and production—and verify that authorization checks are enforced on v2 REST API endpoints post-patch. Test that users with restricted roles cannot access tables or records outside their assigned scope. Verify against the vendor advisory that the specific endpoints mentioned (GET /api/v2/tables/get, POST /api/v2/tables/updateRecords, and related mutation operations) properly enforce permissions.

Detection guidance

Monitor API logs for suspicious patterns: authenticated users accessing tables or schemas they don't own, bulk read operations on /api/v2/tables/get from unexpected accounts, or POST requests to /api/v2/tables/updateRecords from users without data modification roles. Correlate API access with user roles via identity logs; detect privilege escalation attempts where low-privilege accounts access high-sensitivity tables. Look for rapid sequential requests suggesting automated enumeration or exfiltration. Enable verbose API request logging including user ID, IP, requested resource IDs, and response codes. Consider API gateway rules to rate-limit or flag bulk schema or record queries.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH severity (CVSS 8.8), low barrier to exploitation (authentication only), and broad impact on data confidentiality and integrity. The authorization bypass affects core business logic—data access control—in any Teable deployment. Insider threat actors and users with compromised credentials can immediately cause data loss or exfiltration. Unlike vulnerabilities requiring special privileges or user interaction, this can be triggered instantly by any authenticated account. Organizations should treat this as critical until patched.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: Network-based attack vector (AV:N), low attack complexity (AC:L), requirement for legitimate credentials (PR:L) but no elevated privileges, no user interaction needed (UI:N), unchanged security scope (S:U), and high impact across all three pillars—confidentiality (schema and record disclosure), integrity (unauthorized data modification), and availability (record deletion). The score appropriately penalizes the broad blast radius of an authorization failure but credits the requirement for some baseline authentication.

Frequently asked questions