CVE-2026-111344 apitable CVE debrief

Who should care

Defenders responsible for APITable instances, particularly those exposed to authenticated users, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and remediate this vulnerability to prevent potential unauthorized access and disclosure of sensitive node descriptions.

Why it matters

Defenders should prioritize verifying and remediating this vulnerability in APITable instances, particularly those exposed to authenticated users, to prevent potential unauthorized access and disclosure of sensitive node descriptions.

• Potential unauthorized access to sensitive node descriptions
• Possible disclosure of cross-tenant datasheet, folder, and form descriptions
• Need for verification of APITable instances for exposure
• Priority for remediation to prevent exploitation

Technical summary

APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips space membership and node permission checks, to disclose cross-tenant datasheet, folder, and form descriptions. The vulnerability is caused by inadequate checks on nodeId, allowing unauthorized access to sensitive information. Defenders should prioritize verifying and remediating this vulnerability in APITable instances, particularly those exposed to authenticated users.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in APITable instances, particularly those exposed to authenticated users.

Recommended defensive actions

• Verify APITable instances for exposure to authenticated users
• Remediate vulnerable APITable instances to prevent unauthorized access
• Monitor APITable instances for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the authorization bypass vulnerability in APITable through 1.14.0-beta. The vulnerability allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.