Description
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
teableio teable
Default version status: unaffected
0 to < 2026-10-12T12-45-53Z.3331affected
pkg:github/teableio/teableReferences
- https://github.com/teableio/teable/security/advisories/GHSA-5qj3-rq3x-q739 ↗
- https://github.com/teableio/teable/commit/3c1c4646bfddfb14b1f2fbab8d0e1189969fa304 ↗
- https://github.com/teableio/teable/releases/tag/release.2026-10-12T12-45-53Z.3331 ↗
- https://github.com/teableio/teable/blob/release.2026-10-02T04-02-20Z.3278/apps/nestjs-backend/src/features/base-node/folder/base-node-folder.service.ts#L39-L67 ↗
- https://www.vulncheck.com/advisories/teable-before-2026-10-12t12-45-53z-3331-authorization-bypass-via-folder-rename-endpoint ↗