{"schema":"threatline.record/2","record":{"id":"CVE-2026-112004","aliases":["GHSA-5qj3-rq3x-q739"],"summary":"Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint","details":"Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.","categories":["Unclassified"],"product":"teable","vendor":"teableio","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112004","source_modified_at":"2026-10-20T15:09:09.557Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"teable","vendor":"teableio","versions":[{"version":"0","lessThan":"2026-10-12T12-45-53Z.3331","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112004","source_modified_at":"2026-10-20T15:09:09.557Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"teable","ecosystem":null},"version":"2026-10-12T12-45-53Z.3331","basis":"first unaffected version stated in the CVE record"}],"cvss":2.3,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00256,"percentile":0.16232,"score_date":"2026-10-23"},"published_at":"2026-10-18T11:38:28.495Z","modified_at":"2026-10-20T15:09:09.557Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-112004","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T15:09:09.557Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112004","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/teableio/teable/security/advisories/GHSA-5qj3-rq3x-q739","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/teableio/teable/commit/3c1c4646bfddfb14b1f2fbab8d0e1189969fa304","tags":["patch"]},{"source":"CVE List","url":"https://github.com/teableio/teable/releases/tag/release.2026-10-12T12-45-53Z.3331","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/teableio/teable/blob/release.2026-10-02T04-02-20Z.3278/apps/nestjs-backend/src/features/base-node/folder/base-node-folder.service.ts#L39-L67","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/teable-before-2026-10-12t12-45-53z-3331-authorization-bypass-via-folder-rename-endpoint","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-20T15:08:57.714792Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-20T15:09:09.557Z","content_hash":"29fc2d0e68fc56ee2632c719fa366a7500f90befec86e2f5fd2c3ffe9480dfcf"}}