CVE-2026-86120
APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 5, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 5, 2026
Description
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been explicitly denied access to by exploiting the unhandled exception in the permission guard.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-636 Not Failing Securely ('Failing Open')
Affected Products
| Product | Versions |
|---|---|
apitableapitable |
|
References
- GitHub Issue #1814issue-tracking
- NodePermissionGuard.matchPermissions empty catchtechnical-description
- https://github.com/apitable/apitableproduct
- VulnCheck Advisory: APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guardthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.