Description

APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been explicitly denied access to by exploiting the unhandled exception in the permission guard.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-05T10:16:43.307Z",
  "pubdate": "2026-09-05T10:16:43.307Z",
  "executiveSummary": "APITable versions up to 1.13.0-beta.1 are vulnerable to an improper authorization flaw within the NodePermissionGuard component.\nThe vulnerability occurs due to inadequate exception handling during the node-level permission verification process, which triggers a fail-open state when a lookup exception is encountered.\nAn attacker possessing a valid Fusion API token can bypass access control mechanisms to perform unauthorized write operations, specifically attaching files to private datasheets.\nThis vulnerability poses a significant risk to data integrity and confidentiality, as it allows authenticated users to circumvent explicit access denials enforced by the system's security policies.\nThe attack requires the adversary to have an existing, albeit restricted, API token and necessitates that the target node's permission lookup logic induces an unhandled exception.\nSuccessful exploitation results in unauthorized modification of restricted datasheets, potentially leading to unauthorized data injection or storage exhaustion within private workspaces.",
  "technicalDetails": "The vulnerability is localized within the NodePermissionGuard function, which is responsible for mediating access control for node-level operations in APITable. The security flaw stems from an unsafe implementation of the permission lookup workflow, specifically involving inadequate handling of runtime exceptions.\nIn the event that the permission lookup logic encounters an unexpected state or error that results in a thrown exception, the NodePermissionGuard fails to default to a 'deny' posture. Instead, the lack of a robust catch-all block or appropriate error handling logic causes the security check to fail open.\nAn attacker can exploit this by utilizing a valid Fusion API token to interact with the system's API endpoints. By targeting a private datasheet for which the attacker has been explicitly denied access, the attacker initiates a request that invokes the vulnerable NodePermissionGuard. If the attacker can manipulate the request parameters or environment to trigger an exception during the permission verification lookup, the guard will bypass the authorization check.\nThe attack flow is as follows: 1) The attacker authenticates using a legitimate Fusion API token. 2) The attacker attempts an attachment write operation on a restricted/private node. 3) The application invokes NodePermissionGuard to validate access. 4) The permission check logic crashes or throws an exception due to a logic error or malicious input. 5) The application fails to handle this exception, allowing the process to continue as if the permission check succeeded. 6) The backend processes the attachment write request, finalizing the unauthorized action.\nThis vulnerability affects APITable versions through 1.13.0-beta.1. The impact of successful exploitation is the circumvention of the application's authorization framework, permitting arbitrary write operations on private nodes despite existing restrictive permissions. This allows for unauthorized data persistence in private areas, which could be utilized for malicious staging, unauthorized file hosting, or tampering with sensitive organizational records."
}