CVE-2026-56781

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-56781
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56781.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-56781
Published
2026-06-29T17:15:49.423Z
Modified
2026-07-16T03:31:00.636955298Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override
Details

Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supplying arbitrary field IDs in the projection parameter of the share view records endpoint. Attackers can enumerate hidden field IDs from share metadata and specify them in projection parameters to read field values that are intended to be restricted from public view.

Database specific 
{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56781.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/teableio/teable

Affected ranges

Type
GIT
Repo
https://github.com/teableio/teable
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1e353a0e98d2a6da372a635ce5b1744c071eef3b
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026-06-15T04-43-24Z.1912"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

release.*
release.2026-04-21T08-57-20Z.1513
release.2026-04-21T13-16-47Z.1517
release.2026-04-23T10-09-31Z.1545
release.2026-04-24T08-22-25Z.1554
release.2026-04-28T09-22-07Z.1576
release.2026-04-29T09-04-10Z.1585
release.2026-04-29T12-41-46Z.1591
release.2026-05-06T00-14-49Z.1601
release.2026-05-07T09-04-09Z.1611
release.2026-05-12T00-30-35Z.1655
release.2026-05-12T16-05-24Z.1665
release.2026-05-18T01-54-38Z.1703
release.2026-05-21T09-38-56Z.1747
release.2026-05-22T03-29-48Z.1753
release.2026-05-25T04-58-10Z.1765
release.2026-05-28T03-48-48Z.1788
v1.*
v1.0.0-beta
v1.10.0
v1.2.0-beta
v1.2.1-beta.0
v1.3.0-beta.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56781.json"