APITable up to 1.13.0-beta.1 ResourceInterceptor InternalUserController getUserHistories/closePausedUserAccount improper authentication

Summaryinfo

A vulnerability classified as critical was found in APITable up to 1.13.0-beta.1. This vulnerability affects the function getUserHistories/closePausedUserAccount of the file InternalUserController of the component ResourceInterceptor. Executing a manipulation can lead to improper authentication. This vulnerability is handled as CVE-2026-80208. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in APITable up to 1.13.0-beta.1 and classified as critical. This vulnerability affects the function getUserHistories/closePausedUserAccount of the file InternalUserController of the component ResourceInterceptor. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so both endpoints are reachable by any unauthenticated client that can reach the gateway. An attacker can POST to /api/v1/internal/getUserHistories to enumerate the accounts sitting in the 30-day cooling-off period that follows a deletion request, then POST to /api/v1/internal/users/{userId}/close for each one. The closure path clears the account's email address, phone number and nickname, cancels its space subscriptions, removes its space memberships and deletes its OAuth bindings, so the cooling-off window that exists to let a user reverse a deletion request is bypassed and the account cannot be recovered.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-80208 since 08/26/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/27/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• APITable

Version

• 1.13.0-beta.0
• 1.13.0-beta.1

Website

• Product: https://github.com/apitable/apitable/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion