{"id":"CVE-2026-84485","summary":"APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint","details":"APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hierarchy. Attackers can query the endpoint with space identifiers obtained from shared links or public templates to enumerate the complete member directory of any workspace.","modified":"2026-09-04T08:03:32.593430Z","published":"2026-09-02T01:18:15.643Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-306"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84485.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84485.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84485"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/apitable-through-1.13.0-beta.1-missing-authentication-on-the-internal-organization-load-or-search-endpoint"},{"type":"PACKAGE","url":"https://github.com/apitable/apitable"},{"type":"ARTICLE","url":"https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/internal/controller/InternalOrganizationController.java#L58"},{"type":"ARTICLE","url":"https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/shared/context/LoginContext.java"},{"type":"ARTICLE","url":"https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/shared/interceptor/ResourceInterceptor.java#L85"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apitable/apitable","events":[{"introduced":"0"},{"fixed":"ebf2e0830822336e3583b4be2802965da8eae922"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.13.0-beta.1"},{"fixed":"1.13.0-beta.1"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v1.13.0-beta","v1.10.0-beta","v1.8.0-beta.2","v1.8.0-beta","v1.6.0-beta.1","v1.6.0-beta","v1.5.0-beta.2","v1.5.0-beta","v1.5.0-beta.1","v1.4.0-beta.3","v1.2.0-beta","v1.1.0-beta","v1.0.0-beta","v0.24.0-alpha","v0.23.0-beta.1","v0.19.0-rc"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84485.json","vanir_signatures_modified":"2026-09-04T08:03:32Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/mapper/DatasheetMetaMapper.java"},"deprecated":false,"digest":{"line_hashes":["338797349990888386079145801163637403991","300515928279666064469448966030955642255","274274904986321377378216295211758856144","86572781466731582986399847962167188301","254684434424475422829534254229399102838"],"threshold":0.9},"id":"CVE-2026-84485-063fad36","signature_type":"Line"},{"id":"CVE-2026-84485-0d6da1c1","signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/service/impl/FieldRoleServiceImpl.java"},"deprecated":false,"digest":{"line_hashes":["218123763907384157684111704314836463326","225482924406501613367490039770566064068","45485754318055339257289198457649106540","200609033651997209062467299514045908398"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"49328285291180823736971797862683640440","length":972},"id":"CVE-2026-84485-0ec345e5","signature_type":"Function","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/service/impl/FieldRoleServiceImpl.java","function":"populateFieldRoles"}},{"deprecated":false,"digest":{"function_hash":"259455265480886888345740451374685403191","length":549},"id":"CVE-2026-84485-13b9b656","signature_type":"Function","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"function":"getTeamInfoById","file":"backend-server/application/src/main/java/com/apitable/organization/service/impl/TeamServiceImpl.java"}},{"signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/organization/mapper/TeamMemberRelMapper.java"},"deprecated":false,"digest":{"line_hashes":["218495278231337417398342136674101753847","290415136969755956496158720666988630904","282199474860322412098375785850066784239"],"threshold":0.9},"id":"CVE-2026-84485-2c5c417b","signature_type":"Line"},{"digest":{"function_hash":"87437199091447007437437731295350863975","length":389},"id":"CVE-2026-84485-31766ba1","signature_type":"Function","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/internal/controller/InternalOrganizationController.java","function":"loadOrSearch"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["116171507489317875326632417692782412502","144523255971336507630811732728913400602","10854268627055992743428800677422022666"],"threshold":0.9},"id":"CVE-2026-84485-3c7a8e7e","signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/entity/DatasheetRecordAlarmEntity.java"}},{"id":"CVE-2026-84485-3e66ff1f","signature_type":"Function","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/service/impl/DatasheetServiceImpl.java","function":"remindMemberRecOp"},"deprecated":false,"digest":{"function_hash":"257498234092980592769885857292625234977","length":4570}},{"digest":{"function_hash":"41895218132311986545768955210731173500","length":292},"id":"CVE-2026-84485-472b8d6b","signature_type":"Function","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/player/service/impl/PlayerNotificationServiceImpl.java","function":"createBatch"},"deprecated":false},{"target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/controller/NodeController.java"},"deprecated":false,"digest":{"line_hashes":["83457957143466045168680724134281127384","215040626899525909956335567382716224628","318818649529913021524450920752755024423","125983182977188230164092973112114022263","138035013792214459512496414264968732110","268072404826085427843922422291118446502","138092435982064753934592039628738337562","92720087408388897257267783039079535017","95726249146426627581086715641818976310","308114670580689535991788924140877920626"],"threshold":0.9},"id":"CVE-2026-84485-4baf0ed5","signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922"},{"source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/service/impl/NodeServiceImpl.java"},"deprecated":false,"digest":{"line_hashes":["181662602583439233141927219525007330260","5378638507375857958894078562262076900","175406140450223602415442146464269228101","339012069772854361912241424995912553701","242517937695421899109166515291965729165","236866774093728195600639639690490976853","66745650505599470223363342007417755219","170404218032721463899687862108393003381","123422333484315179685872455111578228725","169731538862547154472316990285144798877","187747188411206180635593579482710378497","124005925518009103718327024788021752830","235161490182228941106268631228207410548","270336661764916415385517404122885053095","169418595078243534056444381725155309012","276203264001821178917248916479839796135","267963415856628346697494460068272532846","99962840938591674116328410954722744841","293324885848671041892790153372874427912","223427826548510400001371311838232155076","269892664957691770131955597619388844863","319528533368742836259916771064596473617","2342564472721620796262836390740989534","146366818358992816044509127741153159645","90266873426474501361870514439177626634","215745007764242255864534142816217778074","305347607975647885083530973044323441496","90616135516693716670970161403489297980","203151979361652508476862800742593911630","192652734941552745466568796082655543199","291721205667909977809376986520564270102","159587925090212182345758814369087921264","226606474366865397728137260956109150784","189663313970252078802850608505644035866","88911240328198999307943601818861948621","235367046995632403640472971613594484534","108369966799388806668323506049337978528","186959755998318165704238692532345377585","269840425598275541426230760426232472911","334220829868591664514606786276888494451","318437798256241012420334857332792985558","186576450187455601263790086160024029703","297265247698297551664886627939826425184","126564069525605970956590823545440133932","242033077580649643152673224673331973869","183365874118090636385066571332994158790"],"threshold":0.9},"id":"CVE-2026-84485-62660d42","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/shared/component/notification/NotificationManager.java"},"deprecated":false,"digest":{"line_hashes":["55132361422855040639666782312507106199","200230841183657494687862938870684921784","212756589569796542538488292260110709920","50979045516908026514911500630751617353","147288116442303189897811159146664491541","291458691014206333766498083919577360801","5018779262397993552965300573438917720","180925141450420104362818126289593031262","82169380934994137125665017761692001207","1365538608716628669842598889387325649","313973762220453600371851927014159815325","208720017687246393469552999636816092050","64788406577243784356512194028822461374","329480298597144761260442452803434779198","2102514523167486194998937103980364461","61261493857530885768894274860947700532","104060576110105430963582453793082531864","76502767458634289772822660531370305635","57853599575462436742366780772943607635"],"threshold":0.9},"id":"CVE-2026-84485-79bb01ce","signature_type":"Line"},{"id":"CVE-2026-84485-7d900c26","signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/player/service/impl/PlayerNotificationServiceImpl.java"},"deprecated":false,"digest":{"line_hashes":["242647081055403982193432068305558892573","280751548449619848469627029647233524098","260315567254924406237293035955127814147","128903622844444162366811307366680949621","134162684799588004339659686780582990525","79794874432964844550003497843014208710","54563519300394592003741686363942288311","104423447669218133571216136814255225632","12963582817674023604265497917512387305","329186662553819063391825545113544468320","241591726725992630700169270554960571231","213046436913629371361809370709116593129"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/interfaces/social/facade/SocialServiceFacade.java"},"deprecated":false,"digest":{"line_hashes":["81727674682057962703311610417639526410","269408553790437425787320163646113845035"],"threshold":0.9},"id":"CVE-2026-84485-80105584","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/organization/dto/LoadSearchDTO.java"},"deprecated":false,"digest":{"line_hashes":["170087641966406612882212117897476706251","67595242896447076318075699858945774208"],"threshold":0.9},"id":"CVE-2026-84485-89dc4bf7"},{"deprecated":false,"digest":{"line_hashes":["328829252563218431372999476963015768643","260302210538362400017226867574785766200"],"threshold":0.9},"id":"CVE-2026-84485-8d2e0bdc","signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/interfaces/social/facade/DefaultSocialServiceFacade.java"}},{"signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"function":"remind","file":"backend-server/application/src/main/java/com/apitable/workspace/controller/NodeController.java"},"deprecated":false,"digest":{"function_hash":"114748027741842677582114071175876302621","length":687},"id":"CVE-2026-84485-8e5b37af","signature_type":"Function"},{"digest":{"length":322,"function_hash":"274133629644431785418288992243806912383"},"id":"CVE-2026-84485-9139acc5","signature_type":"Function","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"function":"checkHasSubUnitByTeamId","file":"backend-server/application/src/main/java/com/apitable/organization/service/impl/TeamServiceImpl.java"},"deprecated":false},{"source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/mapper/NodeMapper.java"},"deprecated":false,"digest":{"line_hashes":["236582212322600391872418943710650759241","212878266505835720180635445853537898144","9623010858543024281109650651730661045","87377907380940215830195384056892814123","234398888944224309193520707938714615057","316521499730308790484286873969352200222","96859220688232001794430016809316714831","306867003828828535448510812768611029106"],"threshold":0.9},"id":"CVE-2026-84485-913b42e4","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"298145791253693194868807087430757773592","length":107},"id":"CVE-2026-84485-9f71bc00","signature_type":"Function","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/organization/service/impl/TeamServiceImpl.java","function":"getMemberCount"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["312581192760436283332523938083933653787","37709924436902567172412743496124160689","105584698760748278881628356681025550985","30996078288598472596081196797563331190","87357560148349259626105842577054258986","169592037311560780100798936639803269129","321092785260842692178550894445224203031","113075151535302714718805960405269454806","238843709689516966044642358926970451022","121468260800209938338828007809382786783","194311542153839044413655618745535445814","291807088000931144775863171662853808740","37083808908914232330526971585601762901","228093191787251189377166769131435380095","321211999610049562112737410411360346242","248500398905964862998354622115305345569","255559345412741737283655867982239985244","177568362329921177414366802321859205551"]},"id":"CVE-2026-84485-a84987ef","signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/organization/service/impl/TeamServiceImpl.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/mapper/NodeShareSettingMapper.java"},"deprecated":false,"digest":{"line_hashes":["90662129840550825456581953321108774782","203537218032521175592461583956325062778","132024885907053073685666407001789284830","43008106142461843939057335245010732289","146941767161034103516508022541099941779","242651086322463062916836535532609515128","183202529036705318977959392955322287215","23773584870936307887812505970507782146"],"threshold":0.9},"id":"CVE-2026-84485-a9262986"},{"id":"CVE-2026-84485-b36abfaf","signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/dto/NodeShareDTO.java"},"deprecated":false,"digest":{"line_hashes":["302090447066981215370739166026905100109","287044374417982556234095125319786768586"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/organization/service/impl/TeamServiceImpl.java","function":"countMemberCountByParentId"},"deprecated":false,"digest":{"function_hash":"326021455839028439743247806556354927219","length":261},"id":"CVE-2026-84485-b7af50af"},{"digest":{"threshold":0.9,"line_hashes":["200314844623031448199200831472680298304","298179318598925255449986710600136474525","57270037401507307255758228639084372718","20027576980556495593860539329384202443","170732536124449105347477953378523177878","288957511363381230281711204591215837021","263883558325212129111169781258270436053","177921808311402906738970257979905807433","59038125082945267420869847828707488196","2748818766694076892876904907228050314","218191217487689601694343479821596888102","125634515377857737419909919064746891524","59892853049405876880746222681131178350","214131329313308120996142475424397724639","66563552962612407173279162778705684623","182037667423280513592270297988671148954","191531970976133747842492172379966880326","234326896455877266647225188735716396550"]},"id":"CVE-2026-84485-b99aedc0","signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/shared/component/notification/observer/AbstractNotifyObserver.java"},"deprecated":false},{"source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/service/impl/DatasheetMetaServiceImpl.java"},"deprecated":false,"digest":{"line_hashes":["74757379703754872479286159165733185749","21918660001603431911814684646785546837","255559891702626099465012380002029485026","200094010379210768183478606434917468301","260214289145214963055913200379529103119","262282764551164358214899577215347935861","273030616079357824630534379444055221704"],"threshold":0.9},"id":"CVE-2026-84485-bace9d0c","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/organization/controller/OrganizationController.java","function":"loadOrSearch"},"deprecated":false,"digest":{"function_hash":"222236405752828945567200355192471968717","length":1029},"id":"CVE-2026-84485-bf3039f3","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-84485-d4902329","signature_type":"Function","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/shared/component/notification/observer/AbstractNotifyObserver.java","function":"bindingMap"},"deprecated":false,"digest":{"length":1541,"function_hash":"210749059806877750099685515287365671675"}},{"id":"CVE-2026-84485-d5d139be","signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/internal/controller/InternalOrganizationController.java"},"deprecated":false,"digest":{"line_hashes":["15592428598962399598605200370425934426","72316428740641425226657531937731923546","222529231985109629532813933974455579985","337061327564716735372256739048939178735","152054724810415275563713559568375069172","9394594238142781550492848872651407885","45751039888910868085240469492875361333","195115386017842578933315862877846901357","122801684529558664870051975729267645400","14131329965281782664819513524343650186","32772822509023452821769764827803184463","52377219714079541014076486003270229828"],"threshold":0.9}},{"target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/service/impl/NodeServiceImpl.java","function":"getNodeInfoTreeByNodeIds"},"deprecated":false,"digest":{"length":929,"function_hash":"80724896422731504831314518333108619061"},"id":"CVE-2026-84485-dd51fc37","signature_type":"Function","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/service/impl/DatasheetServiceImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["86107460036683098918826063700582319687","282830129189041827178052451553674900472","99752793193318532670565886521221446559","99451809434502832758890979476578261504"]},"id":"CVE-2026-84485-de2d6244"},{"id":"CVE-2026-84485-ec15c6a0","signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/service/IDatasheetMetaService.java"},"deprecated":false,"digest":{"line_hashes":["265757156880711111605289558506654059432","300515928279666064469448966030955642255","69479835600202183942996602255799561709","218000859262249092989502699887823185795","18592856215973584830578548593369535500","325087520390959957767424289142302217823","255061490616291026287228623466483311835","263723816336931408703174494745782615451","154060828713224784603074148441358151581","107389050628308520223399751702089478521","169937472679191990759048503189540322373","244990882241136277859318352536322399491"],"threshold":0.9}},{"digest":{"function_hash":"27546052677140040040335522894535963698","length":588},"id":"CVE-2026-84485-fd12c433","signature_type":"Function","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922","target":{"file":"backend-server/application/src/main/java/com/apitable/workspace/service/impl/NodeServiceImpl.java","function":"getNodeInfoByNodeIds"},"deprecated":false},{"target":{"file":"backend-server/application/src/main/java/com/apitable/organization/controller/OrganizationController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["255059691013783528757165091224287777441","284616808337143892943666557817063034160","14194165961064552159351625732040597653","332906171460806257103301761913373549004","152054724810415275563713559568375069172","9394594238142781550492848872651407885","45751039888910868085240469492875361333","178815147404504646678045175925927190170","279069856033807687104730828218679576894","222672366731377766829531149401489047017","32772822509023452821769764827803184463","18399638733656627493939090278268954222"]},"id":"CVE-2026-84485-fe075752","signature_type":"Line","signature_version":"v1","source":"https://github.com/apitable/apitable/commit/ebf2e0830822336e3583b4be2802965da8eae922"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}