CVE-2026-86120: APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been explicitly denied access to by exploiting the unhandled exception in the permission guard.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid Fusion API token. The issue affects attempts to write attachments to private datasheets where that token has been explicitly denied node-level access.
Is an unauthenticated attacker affected by this authorization failure?
No. The available information states that exploitation requires a valid Fusion API token, corresponding to low-privilege authenticated access.
What condition triggers the authorization bypass?
The bypass occurs when the NodePermissionGuard permission lookup throws an exception. In that error condition, node-level access control is not enforced and the guard fails open.
How can teams assess potential exposure?
Review Fusion API token use and identify tokens that can submit attachment writes to private datasheets despite explicit node-level denials. Investigate permission-lookup exceptions in the Fusion API path, because those exceptions are the stated trigger for the fail-open behavior.