The flaw permits an authenticated user to rename folders that belong to bases they are not a member of by specifying an arbitrary folderId in the rename request. The authorization check for base membership is performed only against the URL baseId, so the attacker can target any base where they lack access. This bypass allows manipulation of folder names, potentially obscuring content, causing confusion, or preparing a platform for further exploit attempts. The vulnerability is a classic authorization bypass (CWE-639) and does not provide command execution or data exfiltration, but it alters the metadata of a resource the user is not authorized to manage.

Clients running Teable version prior to release 2026‑10‑12T12‑45‑53Z.3331 are affected. The issue exists in the open‑source project maintained by TeableIO under the teable repository. No other product versions are known to be impacted.

The CVSS score of 2.3 indicates low severity, and the EPSS is not published, suggesting no known active exploitation. Because the flaw is accessed through an authenticated API call, the attacker must have legitimate credentials; however, once authenticated, the attacker can rename folders in any base, creating opportunities for confusion or abuse. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is reported. The risk to a well‑protected environment is moderate, primarily allowing a misused account to alter folder names within other bases.