CVE-2026-80207: Apitable

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so POST /api/v1/internal/notification/create is reachable by any unauthenticated client that can reach the gateway. An attacker can persist arbitrary notifications in apitable_player_notification against any user ID they name, and because fromUserId can be set to 0 the message is stored with the system sender and renders in the victim's inbox as a legitimate system notification. The body extras content is stored verbatim and forwarded to the frontend.

Affected products

• Apitable Apitable: up to and including 1.13.0-beta.1

Published 2026-08-27. Last modified 2026-09-23.