{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-56781 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-56781 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-56781 is a medium-severity missing authorization vulnerability in teableio teable, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-56781 and fix it if it is affected.\n\nWhat it is: CVE-2026-56781 is a medium-severity missing authorization vulnerability in teableio teable, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-56781 in the wild and no public exploit code.\n\nAffected product: teableio teable. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-56781/ (Markdown: https://insights.sbomify.com/CVE-2026-56781/index.md)","id":"CVE-2026-56781","markdown":"https://insights.sbomify.com/CVE-2026-56781/index.md","name":"CVE-2026-56781","record":{"aliases":["GHSA-49fm-7w64-4wqc"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Teable web application","requires_auth":"none","summary":"Anonymous attackers can read hidden field data in Teable by manipulating projection parameters in shared view endpoints.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"}],"description":"Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supplying arbitrary field IDs in the projection parameter of the share view records endpoint. Attackers can enumerate hidden field IDs from share metadata and specify them in projection parameters to read field values that are intended to be restricted from public view.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override","id":"CVE-2026-56781","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints","id":"CVE-2026-56782"},"packages":[],"prev":{"headline":"Modoboa \u003c 2.9.0 - Insecure Direct Object Reference in Account Password Change API","id":"CVE-2026-56780"},"products":["teable"],"published":"2026-06-29","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-07-14","vendors":["teableio"]},"summary":"Anonymous attackers can read hidden field data in Teable by manipulating projection parameters in shared view endpoints.","url":"https://insights.sbomify.com/CVE-2026-56781/"}