---
id: CVE-2026-84485
title: >-
  APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch
  endpoint without authentication, allowing unauthenticated attackers to
  retrieve member names, email addresses, and team hierarchy
summary: >-
  APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch
  endpoint without authentication, allowing unauthenticated attackers to
  retrieve member names, email addresses, and team hierarchy. Attackers can
  query the endp…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-306
published: '2026-09-02'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:43.907'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84485'
references:
  - url: 'https://github.com/apitable/apitable'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/internal/controller/InternalOrganizationController.java#L58
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/shared/context/LoginContext.java
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend-server/application/src/main/java/com/apitable/shared/interceptor/ResourceInterceptor.java#L85
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/apitable-through-1.13.0-beta.1-missing-authentication-on-the-internal-organization-load-or-search-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00612
epssPercentile: 0.4702
ingestedAt: '2026-09-23T17:28:14.820Z'
vendor: apitable
product: apitable
affected:
  - apitable <= 1.13.0-beta.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-02T10:27:25.321478Z'
---

## Overview

APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hierarchy. Attackers can query the endpoint with space identifiers obtained from shared links or public templates to enumerate the complete member directory of any workspace.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.