Vulnerability · Published Jun 29, 2026 · Assigned by VulnCheck

CVE-2026-56781Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override

Medium 5.3

In plain English

A medium-severity authorization bypass via user-controlled key in teable from teableio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 65.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supplying arbitrary field IDs in the projection parameter of the share view records endpoint. Attackers can enumerate hidden field IDs from share metadata and specify them in projection parameters to read field values that are intended to be restricted from public view.

Affected products (as reported)

Vendor	Product	Versions
teableio	teable	0 – before 2026-06-15T04-43-24Z.1912

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Release Notes release-notes
Researcher Disclosure issue-tracking
Pull Request issue-tracking
https://www.vulncheck.com/advisories/teable-unauthenticated-hidden-field-disclosure-via-projection-parameter-override third-party-advisory