CVE-2026-112004

Published: Oct 18, 2026Modified: Oct 20, 2026Deferred

2.3

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (6)

https://github.com/teableio/teable/blob/release.2026-10-02T04-02-20Z.3278/apps/nestjs-backend/src/features/base-node/folder/base-node-folder.service.ts#L39-L67

Source: disclosure@vulncheck.com

https://github.com/teableio/teable/commit/3c1c4646bfddfb14b1f2fbab8d0e1189969fa304

Source: disclosure@vulncheck.com

https://github.com/teableio/teable/releases/tag/release.2026-10-12T12-45-53Z.3331

Source: disclosure@vulncheck.com

https://github.com/teableio/teable/security/advisories/GHSA-5qj3-rq3x-q739

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/teable-before-2026-10-12t12-45-53z-3331-authorization-bypass-via-folder-rename-endpoint

Source: disclosure@vulncheck.com

https://github.com/teableio/teable/security/advisories/GHSA-5qj3-rq3x-q739

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.