Vulnerability Description
APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hierarchy. Attackers can query the endpoint with space identifiers obtained from shared links or public templates to enumerate the complete member directory of any workspace.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/apitable/apitable
- https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc
- https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc
- https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc
- https://www.vulncheck.com/advisories/apitable-through-1.13.0-beta.1-missing-auth
FAQ
What is CVE-2026-84485?
CVE-2026-84485 is a vulnerability with a CVSS score of 7.5 (HIGH). APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hi...
How severe is CVE-2026-84485?
CVE-2026-84485 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-84485?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.