Vulnerability · Published Sep 5, 2026 · Assigned by VulnCheck

CVE-2026-86120APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard

Medium 4.3

In plain English

A medium-severity security flaw in apitable from apitable. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 69.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been explicitly denied access to by exploiting the unhandled exception in the permission guard.

Affected products (as reported)

Vendor	Product	Versions
apitable	apitable	0 – through 1.13.0-beta.1

Weakness: CWE-636 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

GitHub Issue #1814 issue-tracking
NodePermissionGuard.matchPermissions empty catch technical-description
https://github.com/apitable/apitable product
VulnCheck Advisory: APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard third-party-advisory