CVE-2026-112004: Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated and have base|update permission on at least one base. They do not need membership in the base containing the folder they rename.
Which deployments are exposed?
Teable versions before 2026-10-12T12-45-53Z.3331 are affected. The issue is in the folder rename API endpoint, which authorizes against the baseId in the URL rather than the folder's actual base.
What is the impact of successful exploitation?
An attacker can rename folders in other bases by providing a folderId belonging to a base where they lack membership. The reported impact is unauthorized modification of folder names.