Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-112004: Teable lets users rename any folder across bases

CVE-2026-112004 · published today

Summary

In Teable, a signed‑in user can change the name of a folder that belongs to a different workspace by sending a specially crafted request. The system only checks the workspace ID in the URL, not the folder itself, so users can affect folders they shouldn't have access to. Apply the vendor's update or restrict folder‑rename API access until the fix is installed.

What to do

Update teableio teable to version 2026-10-12T12-45-53Z.3331 or later.

Affected software

Vendor	Product	Affected versions
teableio	teable	< 2026-10-12T12-45-53Z.3331

Original advisory text

Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.

References

https://github.com/teableio/teable/blob/release.2026-10-02T04-02-20Z.3278/apps/n... Third Party Advisory
https://github.com/teableio/teable/commit/3c1c4646bfddfb14b1f2fbab8d0e1189969fa3... Patch
https://github.com/teableio/teable/releases/tag/release.2026-10-12T12-45-53Z.333... Vendor Advisory
https://github.com/teableio/teable/security/advisories/GHSA-5qj3-rq3x-q739 Vendor Advisory
https://www.vulncheck.com/advisories/teable-before-2026-10-12t12-45-53z-3331-aut... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-1120... Vendor Advisory
https://github.com/teableio/teable Product
https://nvd.nist.gov/vuln/detail/CVE-2026-112004 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.3 High

Type

CWE-639Authorization Bypass Through User-Controlled Key

Timeline

Published18 Oct 2026

Updated19 Oct 2026

First seen18 Oct 2026

Sources

CVE-2026-112004 · NVD

CVE-2026-112004 · MITRE

CVE-2026-112004 · OSV

GHSA-5qj3-rq3x-q739 · GHSA

Track software like this

Free during beta