CVE-2026-56773

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-56773
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56773.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-56773
Published
2026-06-26T14:38:32.177Z
Modified
2026-07-16T03:31:00.821744090Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Teable - Missing Authorization in v2 REST API
Details

Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56773.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/teableio/teable

Affected ranges

Type
GIT
Repo
https://github.com/teableio/teable
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1e353a0e98d2a6da372a635ce5b1744c071eef3b
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026-06-15T04-43-24Z.1912"
        }
    ]
}

Affected versions

release.*
release.2026-04-21T08-57-20Z.1513
release.2026-04-21T13-16-47Z.1517
release.2026-04-23T10-09-31Z.1545
release.2026-04-24T08-22-25Z.1554
release.2026-04-28T09-22-07Z.1576
release.2026-04-29T09-04-10Z.1585
release.2026-04-29T12-41-46Z.1591
release.2026-05-06T00-14-49Z.1601
release.2026-05-07T09-04-09Z.1611
release.2026-05-12T00-30-35Z.1655
release.2026-05-12T16-05-24Z.1665
release.2026-05-18T01-54-38Z.1703
release.2026-05-21T09-38-56Z.1747
release.2026-05-22T03-29-48Z.1753
release.2026-05-25T04-58-10Z.1765
release.2026-05-28T03-48-48Z.1788
v1.*
v1.0.0-beta
v1.10.0
v1.2.0-beta
v1.2.1-beta.0
v1.3.0-beta.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56773.json"