CVE-2026-82983: Infoleak
The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels.
This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user must already have read-data access to a shared table. They do not need manage-level permission, and exploitation requires calling the share-listing endpoint directly rather than relying on the web UI.
What information can be exposed?
The endpoint can disclose the full list of users, groups, and teams that a table is shared with, along with each recipient's permission level. It does not grant access to table data beyond the access the user already has.
How can I determine whether this affects my deployment?
Review whether users with only read-data access can request GET /apps/tables/share/table/{tableId} and receive the table's complete share-recipient list and permission levels. Affected behavior is present if that response is returned without manage-level permission.