APITable versions up to 1.13.0-beta.1 expose an internal loadOrSearch API endpoint without requiring any authentication. The publicly accessible endpoint returns sensitive data, including user names, email addresses, and organizational hierarchy. This flaw allows an attacker to gather a complete view of a workspace’s member directory. The vulnerability class is CWE-306, representing missing authentication, which can lead to confidential data exposure and potential further compromise if additional credentials or roles are inferred from the leaked data.

The affected product is APITable, specifically the backend server exposed through the internal organization loadOrSearch endpoint. All releases from the start of version 1.0 up to 1.13.0-beta.1 are impacted, as the source code referenced shows the lack of authentication checks in that range.

The CVSS score for this vulnerability is 8.7, indicating a high severity level. The EPSS score is not available, so the current probability of exploitation cannot be quantified, but because the endpoint is publicly reachable and requires no credentials, the attack bar is low. No listing in the CISA KEV catalog suggests that no known public exploits have been observed yet. Based on the description, the likely attack vector is a direct HTTP request to the internal endpoint from the internet, making exploitation straightforward for any unauthenticated actor who can discover the endpoint URL and provides a space identifier that can be obtained via shared links or public templates. The impact is purely data disclosure, but the accidental visibility of organizational structure could assist attackers in planning targeted attacks or social engineering against team members.