CVE-2026-56781 Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override
Anonymous attackers can read hidden field data in Teable by manipulating projection parameters in shared view endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56781?
CVE-2026-56781 is a medium-severity missing authorization vulnerability in teableio teable, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supplying arbitrary field IDs in the projection parameter of the share view records endpoint. Attackers can enumerate hidden field IDs from share metadata and specify them in projection parameters to read field values that are intended to be restricted from public view.
Weakness: CWE-639
Which versions are affected by CVE-2026-56781?
How do I fix CVE-2026-56781?
No fix has been published for CVE-2026-56781 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-56781 being exploited?
There is no known exploitation of CVE-2026-56781 in the wild and no public exploit code.
Sources
Also known as GHSA-49fm-7w64-4wqc.