CyberRota Analysis
AI-GeneratedAPITable versions up to 1.13.0-beta.1 have a vulnerability in the InternalNotifyController that allows unauthenticated clients to access the POST /api/v1/internal/notification/create endpoint through the Nginx gateway. This flaw enables attackers to create arbitrary notifications for any user, potentially impersonating system messages and delivering malicious content directly to victims' inboxes. Organizations using APITable should prioritize patching this vulnerability to prevent unauthorized access and potential exploitation of their notification system.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so POST /api/v1/internal/notification/create is reachable by any unauthenticated client that can reach the gateway. An attacker can persist arbitrary notifications in apitable_player_notification against any user ID they name, and because fromUserId can be set to 0 the message is stored with the system sender and renders in the victim's inbox as a legitimate system notification. The body extras content is stored verbatim and forwarded to the frontend.