CVE-2026-80207

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so POST /api/v1/internal/notification/create is reachable by any unauthenticated client that can reach the gateway. An attacker can persist arbitrary notifications in apitable_player_notification against any user ID they name, and because fromUserId can be set to 0 the message is stored with the system sender and renders in the victim's inbox as a legitimate system notification. The body extras content is stored verbatim and forwarded to the frontend.

• CWE-306

• https://github.com/apitable/apitable
• https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/internal/controller/InternalNotifyController.java#L50
• https://github.com/apitable/apitable/issues/1813
• https://www.vulncheck.com/advisories/apitable-through-1.13.0-beta.1-missing-authentication-on-the-internal-notification-create-endpoint
• https://github.com/apitable/apitable/issues/1813

Published

Aug 27, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-80201Kimai before 2.53.0 fails to block sensitive User methods in…2
• CVE-2026-80202Kimai before 2.56.0 does not enforce team-membership checks …8.8
• CVE-2026-80203The getgrav/grav-plugin-api plugin before 1.0.18 does not en…9.8
• CVE-2026-80204The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 …5.4
• CVE-2026-80205NLTK versions before 3.10.0 contain a regular expression den…7.5
• CVE-2026-80206NLTK before 3.10.3 contains a regular expression denial of s…5.9
• CVE-2026-80208APITable through 1.13.0-beta.1 annotates both getUserHistori…8.2
• CVE-2026-80209The updateWorkspace handler in mods/identity/src/workspaces/…4.3
• CVE-2026-8021Script injection in UI in Google Chrome prior to 148.0.7778.…4.2
• CVE-2026-80210FrontAccounting through 2.4.20 generates a CSRF token in end…6.5
• CVE-2026-80211FrontAccounting through 2.4.20 stores and verifies user pass…5.9
• CVE-2026-80212An issue was discovered in the resolv gem before 0.7.2 for R…7.5