CVE-2026-112004 teableio CVE debrief

Who should care

Defenders responsible for Teable deployments should assess exposure and verify versions, as authenticated users may be able to rename folders in bases where they lack membership. This includes reviewing current Teable versions, understanding the authorization bypass, and taking appropriate measures to secure their environments. Operators and security teams need to prioritize verifying affected deployments and implementing compensating controls.

Why it matters

CVE-2026-112004 is an authorization bypass vulnerability in Teable that allows authenticated users to rename folders in other bases. Defenders should prioritize verifying Teable versions and assessing exposure.

• Authenticated users may be able to rename folders in bases where they lack membership.
• Defenders need to verify Teable versions and assess exposure.

Technical summary

The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, allowing attackers to rename folders in bases where they lack membership. This authorization bypass vulnerability exists in Teable versions before 2026-10-12T12-45-53Z.3331, affecting authenticated users' ability to interact with folder renaming across different bases. The issue arises from insufficient checks on folderId, enabling potential attackers to manipulate folder names outside their authorized access.

Defensive priority

Defenders should prioritize verifying Teable versions and assessing exposure, as authenticated users may be able to rename folders in bases where they lack membership.

Recommended defensive actions

• Verify Teable versions and assess exposure
• Restrict access to authenticated users
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The vulnerability is described in the CVE record and NVD entry. The source references provide additional details, including code snippets and commit history. Defenders should verify Teable versions and assess exposure with limited source detail, focusing on CVE and NVD information. Evidence limits suggest cautious verification of affected scope and vendor claims.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.