Description
APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips space membership and node permission checks, to disclose cross-tenant datasheet, folder, and form descriptions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
apitable apitable
Default version status: unaffected
0 to ≤ 1.14.0-betaaffected
pkg:github/apitable/apitableReferences
- https://hackmd.io/@hieuPenguinnn/apitable-node-description-cross-space-idor ↗
- https://github.com/apitable/apitable/blob/v1.14.0-beta/backend-server/application/src/main/java/com/apitable/workspace/controller/NodeController.java#L1043-L1057 ↗
- https://github.com/apitable/apitable ↗
- https://www.vulncheck.com/advisories/apitable-through-1.14.0-beta-authorization-bypass-via-get-node-nodeid-description ↗