CVE-2026-84485

APITable through 1.13.0-beta.1 leaves its internal organization loadOrSearch endpoint accessible without any authentication (CWE-306). An unauthenticated remote attacker who obtains a space identifier from a shared link or a public template can call the endpoint and enumerate the full member directory of the corresponding workspace. The attacker gains member names, email addresses, and the team/organizational hierarchy, which enables reconnaissance, targeted phishing, and social engineering against the workspace's users. Any APITable deployment at or below version 1.13.0-beta.1 that exposes the endpoint to untrusted networks is affected, particularly instances reachable from the internet where sharing links or public templates are in use. Exploitation has not been publicly documented: there is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns a low 0.3% probability of exploitation in the next 30 days.

What to do: No fixed version is provided in the available data, so monitor for an upstream release newer than 1.13.0-beta.1 and upgrade when available. As an interim mitigation, restrict unauthenticated access to the organization loadOrSearch endpoint (for example via a reverse proxy or WAF rule requiring authentication for that route) and limit internet exposure of APITable instances. Review shared links and public templates to identify which workspace space identifiers are externally discoverable and assess what member data could already have been enumerated.