Live › vulnerability › CVE-2026-82983
Go to dashboardThe Tables app's GET /apps/tables/share/table/{tableId} endpoint did not check manage permission before returning every share recipient and their access level. A user with only read-data access can call it directly and list who else the table is shared with.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Teams running the Tables app on a server where some users have read-only access to shared tables. The exposure is the list of share recipients and their permission levels, not table contents beyond what the read grant already allows. Sites that do not use the Tables app, or that give shared users no read-only grants, can skip it.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels.
This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels.
This page as .md · .json · in your agent: get_signal("CVE-2026-82983")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.