CVE-2026-56773

highCVSS 8.8covered by 1 sourcefirst seen 2026-06-26

Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.

⚡ Watch CVE-2026-56773

Get an email if CVE-2026-56773 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-56773: Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any au…nvd · 2026-06-26

External references

NVD record for CVE-2026-56773

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-56773 status](https://www.csirts.com/badge/CVE-2026-56773)](https://www.csirts.com/cve/CVE-2026-56773)