APITable up to version 1.13.0-beta.1 includes an internal notification creation endpoint whose authentication check is disabled. The missing requiredLogin annotation allows any client that can reach the gateway to post a notification to a user’s inbox. The attacker can choose any user ID and set the fromUserId to 0 so the message appears as a legitimate system‑generated notification, and the body content is stored and forwarded verbatim to the frontend. This omission is a classic authentication bypass (CWE‑306) that permits unauthorized data manipulation and could be used for phishing or information disclosure.

The vulnerability affects APITable versions up through 1.13.0‑beta.1. Sonly versions prior to this release do not contain the patch that enforces authentication on the /api/v1/internal/notification/create endpoint.

With a CVSS score of 6.9 and no EPSS data reported, the exploit is considered moderate in severity. Because the endpoint is reachable through the nginx gateway that proxies all /api traffic, an attacker with network access to the gateway can exploit the flaw without authentication. The vulnerability is not listed in CISA’s KEV catalog, but once an authenticated notification is injected, it can appear as a legitimate system message, potentially enabling social engineering or hiding malicious payloads.