Teable’s v2 REST API controller does not expose the necessary @Permissions metadata on its ORPC endpoints, creating a flaw that allows any authenticated user to bypass all authorization controls. Attackers can read table schemas, create tables, and alter or delete records across any base or table through standard endpoints such as GET /api/v2/tables/get and POST /api/v2/tables/updateRecords. This breach exposes sensitive data, permits integrity violations, and can lead to denial of service if critical tables are deleted. The vulnerability aligns with CWE‑862: Missing Authorization.

The flaw appears in the Teable product offered by teableio under the vendor name Teable. All users of the v2 REST API are impacted; no specific product version range is listed in the available data, so the fix applies to all exposed API endpoints across any deployed instance.

The CVSS score of 8.7 indicates a high severity, and the EPSS score is listed as unavailable, implying that while the exploit is feasible, current data does not suggest widespread real‑world usage. Because the flaw requires only authentication, any legitimate user credential can be abused. The vulnerability is not listed in the CISA KEV catalog, but the combination of high impact and broad accessibility makes it a critical risk for organizations relying on Teable for data storage and manipulation.