The vulnerability arises from missing authentication checks on two internal endpoints in the Apitable backend: one that lists users still in the 30‑day cooling‑off period after a deletion request, and another that permanently removes an account and its associated services. Because the API gateway proxies all /api traffic, any client that can reach the gateway can call these endpoints without being authenticated, enumerate eligible accounts, and immediately close each one. The closure operation clears the account’s email, phone number, nickname, cancels space subscriptions, removes space memberships and deletes OAuth bindings, thereby preventing the user from recovering the account within the intended window.

Apitable, version 1.13.0‑beta.1 and earlier, is affected. No other vendor or product versions are listed as vulnerable.

The CVSS score of 8.8 indicates high severity. EPSS data is not available, and the vulnerability is not yet listed in CISA’s KEV catalog. Based on the description, the likely attack vector is through the exposed internal API routes via the nginx gateway, requiring only network access to the gateway and no prior authentication. An attacker can enumerate accounts in the cooling‑off period and then immediately close them, effectively bypassing the deletion recovery mechanism.