CVE-2026-80207: APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint
APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so POST /api/v1/internal/notification/create is reachable by any unauthenticated client that can reach the gateway. An attacker can persist arbitrary notifications in apitableplayernotification against any user ID they name, and because fromUserId can be set to 0 the message is stored with the system sender and renders in the victim's inbox as a legitimate system notification. The body extras content is stored verbatim and forwarded to the frontend.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated client that can reach the APITable nginx gateway can send requests to the affected endpoint. No session or API key is required.
What access or user interaction is required for exploitation?
The attacker only needs network access to the gateway and the ability to issue a POST request to /api/v1/internal/notification/create. No privileges or user interaction are required.
What is the practical impact on users?
An attacker can create notifications for any specified user ID. By setting fromUserId to 0, the notification appears in the victim's inbox as a system-generated message; the supplied extras content is stored verbatim and forwarded to the frontend.
How can I determine whether an installation is affected?
Installations of APITable through 1.13.0-beta.1 are affected if the nginx gateway is reachable and proxies /api requests to the backend server, as shipped with the product. The relevant unauthenticated route is POST /api/v1/internal/notification/create.