CVE-2026-111344: APITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description
APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips space membership and node permission checks, to disclose cross-tenant datasheet, folder, and form descriptions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated APITable user can exploit it. The attacker does not need to be a member of the target space or have permission on the target node.
What information can be exposed?
The vulnerable endpoint can disclose descriptions of datasheets, folders, and forms in other spaces. The issue affects confidentiality only; no integrity or availability impact is described.
What must an attacker know or control?
The attacker must be able to authenticate and supply a nodeId for a node in another space when requesting GET /node/{nodeId}/description. No user interaction is required.
Are default permission checks sufficient to prevent exploitation?
No. The affected endpoint skips both space-membership checks and node-permission checks, so normal authorization boundaries do not protect node descriptions requested through this route.
How can teams assess exposure?
Review authenticated requests to GET /node/{nodeId}/description, particularly requests for node IDs belonging to spaces the requesting user does not belong to. Systems running APITable through 1.14.0-beta are identified as affected.