APITable versions up to 1.14.0‑beta allow an authenticated user to retrieve node descriptions from any space by sending a GET to /node/{nodeId}/description. The request bypasses both space membership and node permission checks, exposing sensitive information such as datasheet, folder, and form descriptions. This flaw is an instance of ‘Authorization Bypass for User Controlled Search’ (CWE‑639) and can lead to confidential data leakage across tenants.

The affected product is APITable, version 1.14.0‑beta and any earlier releases that contain the same API logic. The vulnerability resides in the backend NodeController handler and requires an authenticated request to the exposed endpoint.

The CVSS score is 5.3, indicating moderate impact. EPSS score is < 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Attackers need only a valid credential to the system; no additional privileges are required beyond user authentication. Once the request is made, the endpoint provides description data from any space the attacker supplies via the nodeId, making exploitation straightforward for internal users or attackers who have compromised an account. The lack of space membership checks creates a consistent attack vector across all spaces that a user can authenticate to.