CVE-2026-80208

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so both endpoints are reachable by any unauthenticated client that can reach the gateway. An attacker can POST to /api/v1/internal/getUserHistories to enumerate the accounts sitting in the 30-day cooling-off period that follows a deletion request, then POST to /api/v1/internal/users/{userId}/close for each one. The closure path clears the account's email address, phone number and nickname, cancels its space subscriptions, removes its space memberships and deletes its OAuth bindings, so the cooling-off window that exists to let a user reverse a deletion request is bypassed and the account cannot be recovered.

• CWE-306

• https://github.com/apitable/apitable
• https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/internal/controller/InternalUserController.java#L149
• https://github.com/apitable/apitable/issues/1812
• https://www.vulncheck.com/advisories/apitable-through-1.13.0-beta.1-missing-authentication-on-the-internal-account-closure-endpoints

Published

Aug 27, 2026

Last Modified

Aug 28, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-80202Kimai before 2.56.0 does not enforce team-membership checks …8.8
• CVE-2026-80203The getgrav/grav-plugin-api plugin before 1.0.18 does not en…9.8
• CVE-2026-80204The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 …5.4
• CVE-2026-80205NLTK versions before 3.10.0 contain a regular expression den…7.5
• CVE-2026-80206NLTK before 3.10.3 contains a regular expression denial of s…5.9
• CVE-2026-80207APITable through 1.13.0-beta.1 annotates the create handler …5.3
• CVE-2026-80209The updateWorkspace handler in mods/identity/src/workspaces/…4.3
• CVE-2026-8021Script injection in UI in Google Chrome prior to 148.0.7778.…4.2
• CVE-2026-80210FrontAccounting through 2.4.20 generates a CSRF token in end…6.5
• CVE-2026-80211FrontAccounting through 2.4.20 stores and verifies user pass…5.9
• CVE-2026-80212An issue was discovered in the resolv gem before 0.7.2 for R…7.5
• CVE-2026-80213An issue was discovered in the resolv gem before 0.7.2 for R…4