Live › vulnerability › CVE-2026-112004
Go to dashboardTeable, a spreadsheet-style database app, checks base update permission only against the base in the URL, so a logged-in user can supply a folder ID from another base. An attacker can rename folders in bases they are not members of.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or hosted Teable instances that run a build before 2026-10-12T12-45-53Z.3331 and have user accounts beyond a single trusted team. Exposure requires an authenticated account; single-tenant deployments where every user already has access to every base are low risk.
No product ranges from the sources yet.
2026-10-12T12-45-53Z.33312026-10-12T12-45-53Z.3331 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.
This page as .md · .json · in your agent: get_signal("CVE-2026-112004")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.