CVE-2026-112004

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112004
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112004.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112004
Aliases
  • GHSA-5qj3-rq3x-q739
Published
2026-10-18T11:38:28Z
Modified
2026-10-19T02:45:46Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint
Details

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112004.json"
}
References

Affected packages

Git / github.com/teableio/teable

Affected ranges

Type
GIT
Repo
https://github.com/teableio/teable
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3c1c4646bfddfb14b1f2fbab8d0e1189969fa304
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2026-10-12T12-45-53Z.3331"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

release.*
release.2026-04-21T08-57-20Z.1513
release.2026-04-21T13-16-47Z.1517
release.2026-04-23T10-09-31Z.1545
release.2026-04-24T08-22-25Z.1554
release.2026-04-28T09-22-07Z.1576
release.2026-04-29T09-04-10Z.1585
release.2026-04-29T12-41-46Z.1591
release.2026-05-06T00-14-49Z.1601
release.2026-05-07T09-04-09Z.1611
release.2026-05-12T00-30-35Z.1655
release.2026-05-12T16-05-24Z.1665
release.2026-05-18T01-54-38Z.1703
release.2026-05-21T09-38-56Z.1747
release.2026-05-22T03-29-48Z.1753
release.2026-05-25T04-58-10Z.1765
release.2026-05-28T03-48-48Z.1788
release.2026-05-29T09-31-13Z.1795
release.2026-06-02T05-27-18Z.1813
release.2026-06-03T15-01-34Z.1831
release.2026-06-12T04-10-05Z.1889
release.2026-06-12T12-22-48Z.1902
release.2026-06-15T04-43-24Z.1912
release.2026-06-24T05-17-06Z.2008
release.2026-06-25T03-23-10Z.2023
release.2026-06-27T08-41-47Z.2047
release.2026-06-27T13-21-06Z.2048
release.2026-06-29T14-46-48Z.2065
release.2026-07-01T05-39-23Z.2076
release.2026-07-01T07-05-50Z.2077
release.2026-07-02T03-46-01Z.2085
release.2026-07-02T15-09-23Z.2097
release.2026-07-05T07-17-25Z.2114
release.2026-07-09T01-07-09Z.2166
release.2026-07-10T08-55-57Z.2188
release.2026-07-11T07-40-17Z.2198
release.2026-07-14T12-24-39Z.2228
release.2026-07-15T16-27-51Z.2242
release.2026-07-17T05-20-38Z.2264
release.2026-07-17T14-54-52Z.2273
release.2026-07-18T09-45-26Z.2275
release.2026-07-20T06-51-40Z.2282
release.2026-07-20T11-53-25Z.2296
release.2026-07-21T00-26-02Z.2300
release.2026-07-21T04-38-35Z.2304
release.2026-07-21T11-27-40Z.2320
release.2026-07-21T13-56-22Z.2328
release.2026-07-22T11-07-01Z.2343
release.2026-07-23T05-14-03Z.2350
release.2026-07-23T08-40-34Z.2355
release.2026-07-23T12-32-52Z.2361
release.2026-07-26T01-04-56Z.2377
release.2026-07-27T06-04-51Z.2385
release.2026-07-27T10-51-13Z.2393
release.2026-07-30T06-45-38Z.2429
release.2026-08-05T06-42-00Z.2495
release.2026-08-05T08-59-48Z.2496
release.2026-08-05T11-23-43Z.2499
release.2026-08-06T02-02-38Z.2503
release.2026-08-06T09-58-00Z.2518
release.2026-08-06T11-43-30Z.2519
release.2026-08-07T05-00-09Z.2531
release.2026-08-07T08-07-22Z.2536
release.2026-08-08T06-34-24Z.2542
release.2026-08-08T09-33-10Z.2547
release.2026-08-08T14-46-52Z.2550
release.2026-08-09T04-03-28Z.2554
release.2026-08-09T08-35-12Z.2557
release.2026-08-09T10-14-07Z.2559
release.2026-08-09T13-07-40Z.2563
release.2026-08-09T14-50-08Z.2564
release.2026-08-10T07-45-10Z.2574
release.2026-08-11T13-42-32Z.2596
release.2026-08-12T12-26-10Z.2619
release.2026-08-14T05-13-33Z.2640
release.2026-08-14T06-35-14Z.2641
release.2026-08-14T12-12-01Z.2647
release.2026-08-18T02-59-03Z.2673
release.2026-08-18T06-53-59Z.2682
release.2026-08-18T10-54-07Z.2696
release.2026-08-19T02-25-59Z.2698
release.2026-08-31T02-56-18Z.2853
release.2026-09-02T03-16-51Z.2899
release.2026-09-02T10-18-27Z.2908
release.2026-09-03T13-21-49Z.2922
release.2026-09-04T09-00-16Z.2928
release.2026-09-04T10-30-33Z.2931
release.2026-09-05T08-43-19Z.2938
release.2026-09-05T12-11-06Z.2942
release.2026-09-05T15-06-03Z.2943
release.2026-09-06T12-49-30Z.2949
release.2026-09-07T01-58-27Z.2952
release.2026-09-07T03-18-00Z.2953
release.2026-09-07T06-05-47Z.2955
release.2026-09-07T09-32-29Z.2963
release.2026-09-07T15-08-33Z.2973
release.2026-09-08T01-36-21Z.2976
release.2026-09-08T05-53-30Z.2982
release.2026-09-08T06-17-32Z.2983
release.2026-09-09T01-48-49Z.2993
release.2026-09-09T04-35-35Z.2997
release.2026-09-09T10-26-44Z.3004
release.2026-09-10T00-17-07Z.3010
release.2026-09-10T06-21-10Z.3025
release.2026-09-11T04-54-54Z.3051
release.2026-09-11T07-36-49Z.3059
release.2026-09-15T10-15-21Z.3095
release.2026-09-16T07-09-26Z.3112
release.2026-09-16T13-34-21Z.3121
release.2026-09-16T14-25-38Z.3122
release.2026-09-17T08-29-35Z.3144
release.2026-09-17T13-29-16Z.3151
release.2026-09-18T12-29-19Z.3168
release.2026-09-19T11-56-47Z.3177
release.2026-09-20T13-36-35Z.3184
release.2026-09-21T07-48-52Z.3187
release.2026-09-21T14-48-39Z.3197
release.2026-09-22T03-34-15Z.3202
release.2026-09-25T04-01-19Z.3254
release.2026-09-25T09-38-50Z.3268
release.2026-09-27T02-14-26Z.3273
release.2026-09-30T04-47-05Z.3276
release.2026-10-02T04-02-20Z.3278
release.2026-10-10T06-11-53Z.3314
v1.*
v1.0.0-beta
v1.10.0
v1.2.0-beta
v1.2.1-beta.0
v1.3.0-beta.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112004.json"