{"id":"CVE-2026-112004","kind":"vulnerability","aliases":["CVE-2026-112004"],"related":[],"title":"Teable: authenticated users can rename folders in other bases","description":"Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.","summary":"Teable, a spreadsheet-style database app, checks base update permission only against the base in the URL, so a logged-in user can supply a folder ID from another base. An attacker can rename folders in bases they are not members of.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","teable"],"not_affected_if":["default-config","single-tenant"],"how_to_check":"- Check the installed Teable version or image tag against the fixed release `2026-10-12T12-45-53Z.3331`\n- unknown","fix":"- Upgrade Teable to `2026-10-12T12-45-53Z.3331` or later\n- unknown","status":"open","published_at":"2026-10-18T12:17:12+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T04:47:49+00:00","updated_at":"2026-10-25T04:47:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:47:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Teable to `2026-10-12T12-45-53Z.3331` or later\n- unknown","reach":"internet","title":"Teable: authenticated users can rename folders in other bases","impact":"low","summary":"Teable, a spreadsheet-style database app, checks base update permission only against the base in the URL, so a logged-in user can supply a folder ID from another base. An attacker can rename folders in bases they are not members of.","category":"package","nicknames":[],"who_cares":["teable","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker renames folders in other users' bases","analyst_note":"","how_to_check":"- Check the installed Teable version or image tag against the fixed release `2026-10-12T12-45-53Z.3331`\n- unknown","needs_analyst":false,"not_affected_if":["default-config","single-tenant"],"who_is_affected":"Self-hosted or hosted Teable instances that run a build before `2026-10-12T12-45-53Z.3331` and have user accounts beyond a single trusted team. Exposure requires an authenticated account; single-tenant deployments where every user already has access to every base are low risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000558,"input_tokens":3351,"output_tokens":446,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-10':67C '-112004':12A,15A '-12':68C '-2026':11A,14A '-45':70C '-53':71C '/api/base':95C '2026':66C 'allow':79C 'anoth':51B 'app':27B 'attack':54B,108C 'authent':2A,80C 'author':75C 'base':9A,29B,35B,52B,59B,87C,100C,113C 'baseid':106C 'baseid/node/folder':96C 'bypass':76C 'check':28B,99C 'contain':73C 'cve':10A,13A 'databas':26B 'endpoint':98C 'folder':6A,48B,57B,84C,111C 'folderid':92C,97C 'foreign':91C 'host':19B 'id':49B 'lack':116C 'log':42B 'logged-in':41B 'member':63B 'membership':117C 'packag':16B 'patch':94C 'permiss':31B 'renam':5A,56B,83C,110C 'self':18B 'self-host':17B 'spreadsheet':24B 'spreadsheet-styl':23B 'style':25B 'suppli':46B,89C 't12':69C 'teabl':1A,20B,21B,64C 'updat':30B,101C 'url':38B,105C 'user':3A,44B,81C 'vulner':77C 'z.3331':72C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or hosted Teable instances that run a build before `2026-10-12T12-45-53Z.3331` and have user accounts beyond a single trusted team. Exposure requires an authenticated account; single-tenant deployments where every user already has access to every base are low risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112004","severity":null,"published_at":"2026-10-18T12:17:12+00:00","modified_at":"2026-10-20T16:17:01+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}