CVE-2026-80207 apitable CVE debrief

Who should care

Defenders responsible for APITable deployments and security should assess exposure and prioritize remediation due to the medium severity risk of unauthenticated notification creation.

Why it matters

CVE-2026-80207 is a medium-severity vulnerability allowing unauthenticated notification creation in APITable, posing a risk to deployments. Defenders should verify and remediate this vulnerability.

• Unauthenticated creation of arbitrary notifications
• Notifications can be stored with the system sender
• Victims may receive notifications as if from the system
• Verification of APITable version and endpoint authentication is required

Technical summary

The vulnerability is caused by the InternalNotifyController's create handler being annotated with requiredLogin = false, which allows unauthenticated clients to create notifications. The nginx gateway proxies /api requests to the backend server, making the endpoint reachable without authentication. An attacker can persist arbitrary notifications in apitable_player_notification against any user ID they name, and because fromUserId can be set to 0 the message is stored with the system sender and renders in the victim's inbox as a legitimate system notification. The body extras content is stored verbatim and forwarded to the frontend. To exploit this vulnerability, an attacker only needs to be able to reach the

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially those responsible for APITable deployments and security.

Recommended defensive actions

• Verify APITable version and check if the system is vulnerable
• Implement authentication for the internal notification create endpoint
• Monitor for suspicious notification activity
• Apply patches or updates provided by the vendor
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability allows unauthenticated creation of notifications due to missing authentication on the internal notification create endpoint. This is supported by the CVE description and source references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.