Description

APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hierarchy. Attackers can query the endpoint with space identifiers obtained from shared links or public templates to enumerate the complete member directory of any workspace.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-02T02:17:20.607Z",
  "pubdate": "2026-09-02T02:17:20.607Z",
  "executiveSummary": "APITable versions up to 1.13.0-beta.1 contain an insecure direct object reference and authentication bypass vulnerability within the 'loadOrSearch' endpoint.\nThe vulnerability manifests as an improper access control flaw, permitting unauthenticated remote attackers to query sensitive organizational metadata.\nAffected systems include the APITable core workspace management module, which fails to validate user sessions for specific internal API requests.\nImpacts include the unauthorized disclosure of personally identifiable information (PII), specifically member names and email addresses, alongside the exposure of sensitive internal team hierarchies.\nThe risk implication is significant, as attackers can perform systematic enumeration of workspace members by iterating through space identifiers, potentially leading to targeted phishing or reconnaissance campaigns.\nExploitation requires no authentication and relies only on obtaining a valid space identifier, which can be harvested from public templates or shared links, lowering the barrier for entry for malicious actors.",
  "technicalDetails": "The vulnerability resides within the organization-level API, specifically the 'loadOrSearch' endpoint responsible for retrieving member directory data. The root cause is a failure in the application's middleware or controller logic to enforce authentication checks before processing requests to this specific function.\nThe application architecture utilizes space identifiers as unique keys for workspace identification. These identifiers are frequently exposed in public-facing URLs, such as shared links or templates, which are intended to provide restricted or read-only access to specific resources. Because the 'loadOrSearch' endpoint lacks proper session validation, any external actor who possesses a valid space identifier can interact with the endpoint to retrieve the complete member list of the associated workspace.\nThe attack flow follows a predictable pattern: First, the attacker identifies a public-facing APITable resource to obtain a target space identifier. Second, the attacker constructs a GET or POST request directed at the '/loadOrSearch' endpoint, incorporating the discovered identifier as a query parameter or body attribute. Third, the application's backend processes the request without verifying the requester's authorization, returning a JSON response containing the full member directory, which includes sensitive PII such as email addresses, display names, and internal organizational structures.\nThe vulnerability is present in all APITable deployments through version 1.13.0-beta.1. Because the endpoint is network-exposed, it can be targeted remotely from any location. The lack of rate limiting or authorization headers (such as JWT validation or session cookies) allows for mass enumeration, where an attacker can automate the harvesting of data across multiple workspaces by scraping or iterating through known or discovered identifiers.\nPost-exploitation impact extends beyond simple information disclosure. By harvesting email addresses and organizational hierarchies, an attacker gains the necessary intelligence to conduct highly effective social engineering or Business Email Compromise (BEC) attacks. The exposure of internal team structures allows attackers to map out command chains and departments, facilitating targeted phishing against high-value individuals within the organization."
}