{"id":"CVE-2026-80207","summary":"APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint","details":"APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so POST /api/v1/internal/notification/create is reachable by any unauthenticated client that can reach the gateway. An attacker can persist arbitrary notifications in apitable_player_notification against any user ID they name, and because fromUserId can be set to 0 the message is stored with the system sender and renders in the victim's inbox as a legitimate system notification. The body extras content is stored verbatim and forwarded to the frontend.","modified":"2026-10-28T02:30:50.713933784Z","published":"2026-08-27T14:50:28.887Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80207.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-306"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80207.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80207"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/apitable-through-1.13.0-beta.1-missing-authentication-on-the-internal-notification-create-endpoint"},{"type":"REPORT","url":"https://github.com/apitable/apitable/issues/1813"},{"type":"PACKAGE","url":"https://github.com/apitable/apitable"},{"type":"ARTICLE","url":"https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/internal/controller/InternalNotifyController.java#L50"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apitable/apitable","events":[{"introduced":"0"},{"last_affected":"ebf2e0830822336e3583b4be2802965da8eae922"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"1.13.0-beta.1"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0"},{"last_affected":"1.13.0-beta.1"}],"source":"DESCRIPTION"}]}}],"versions":["v1.13.0-beta.1","v1.13.0-beta","v1.10.0-beta","v1.8.0-beta.2","v1.8.0-beta","v1.6.0-beta.1","v1.6.0-beta","v1.5.0-beta.2","v1.5.0-beta","v1.5.0-beta.1","v1.4.0-beta.3","v1.2.0-beta","v1.1.0-beta","v1.0.0-beta","v0.24.0-alpha","v0.23.0-beta.1","v0.19.0-rc"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80207.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}