CVE-2026-84485 in APITable
Summary
by MITRE • 09/02/2026
APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hierarchy. Attackers can query the endpoint with space identifiers obtained from shared links or public templates to enumerate the complete member directory of any workspace.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in APITable versions through 1.13.0-beta.1 represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control and aligned with MITRE ATT&CK technique T1078 Valid Accounts for reconnaissance purposes. The core technical flaw lies in the exposure of an internal API endpoint named loadOrSearch without implementing necessary authentication checks or authorization validations. In a properly secured application architecture, endpoints that handle sensitive organizational data such as member directories should be protected by robust identity verification protocols to ensure that only authorized users with appropriate privileges can access them. However, in this instance, the server processes requests to this endpoint regardless of whether an authenticated session is present, effectively treating internal administrative or privileged functions as public resources.
The operational impact of this vulnerability allows unauthenticated attackers to perform comprehensive enumeration of workspace member directories. By leveraging space identifiers that are readily available through shared links or publicly accessible templates, adversaries can query the loadOrSearch endpoint to retrieve detailed information about users within those workspaces. This includes sensitive personal data such as full names and email addresses, as well as structural information regarding team hierarchies. The ability to map out these relationships provides attackers with a high-fidelity view of an organization's internal structure, which is invaluable for subsequent phases of an attack lifecycle including targeted phishing campaigns or social engineering attacks where specific individuals are identified based on their roles and connections within the organization.
This exposure significantly lowers the barrier for initial access in many threat scenarios because it requires no prior credentials to gather intelligence that would typically be considered private. The availability of email addresses facilitates credential stuffing attempts if those emails are associated with other services, while knowledge of team hierarchies allows attackers to prioritize targets who hold higher levels of privilege or influence within the organization. Furthermore, this information can be used to craft highly convincing spear-phishing messages by referencing specific colleagues or organizational structures known only to insiders, thereby increasing the likelihood of successful deception and subsequent compromise of user accounts.
To mitigate this vulnerability, immediate action is required to restrict access to the loadOrSearch endpoint so that it requires valid authentication tokens for every request. Developers should implement strict authorization checks ensuring that users can only query data relevant to their own permissions or explicitly shared contexts where such exposure was intentionally designed by administrators. Additionally, implementing rate limiting on API endpoints can help mitigate automated enumeration attempts even after access controls are enforced. Organizations using affected versions of APITable should upgrade to a patched version as soon as possible and review any logs for signs of unauthorized queries against this endpoint in the past to assess potential data exposure scope.