VULNpocalypse

CVE-2026-112004: Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

What it is

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.

Description quoted from the CVE record (assigned by VulnCheck, published 2026-10-18).

Weakness: Authorization Bypass Through User-Controlled Key

How it can be exploited

Exploitable over the network with low attack complexity only when specific conditions are present needing low privileges and no user interaction. Impact: confidentiality none, integrity low, availability none. CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: no. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Also known as: EUVD-2026-103457, GHSA-f2vw-v2g4-6v2v

VEDAS cluster: VEDAS:DOMINDANCER

Exploit Observer links 3 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (3)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

Vulnerability databases and vendor advisories (3)

Catalogue entries, not exploit evidence.

2 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS
0.003
low predicted chance of attack
VEDAS
0.988
strong exploit evidence
On CISA KEV
Not listed
Detection rule
Suricata

Who is affected

ProductAffectedNot affected
teableio teablebefore 2026-10-12T12-45-53Z.3331Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Fixed versions stated in the CVE record: 2026-10-12T12-45-53Z.3331.

Vendor guidance:

How to detect it

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-112004 Teable - Broken Access Control Folder Rename in Foreign Base. Add them to your Suricata rule set and reload.

Show the rules
suricata
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-112004 Teable - Broken Access Control Folder Rename in Foreign Base"; flow:established,to_server; http.method; content:"PATCH"; http.uri; content:"/api/base/"; nocase; fast_pattern; content:"/node/folder/"; nocase; distance:0; classtype:web-application-attack; reference:cve,CVE-2026-112004; reference:url,https://www.exploit.observer/?keyword=CVE-2026-112004&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=teable&match=exact; metadata:signature_type network_only; sid:1083603; rev:1;)

CVE-2026-112004.rules on GitHub

References

Vendor advisories and patches

Exploits and technical analysis

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.