{"id":12160,"date":"2026-09-04T18:54:09","date_gmt":"2026-09-04T10:54:09","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80208"},"modified":"2026-09-04T18:54:09","modified_gmt":"2026-09-04T10:54:09","slug":"cve-2026-80208","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80208","title":{"rendered":"CVE-2026-80208 [HIGH] &#8211; APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount"},"content":{"rendered":"<p>APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every \/api request to the backend server, so both endpoints are reachable by any unauthenticated client that can reach the gateway. An attacker can POST to \/api\/v1\/internal\/getUserHistories to enumerate the accounts sitting in the 30-day cooling-off period that follows a deletion request, then POST to \/api\/v1\/internal\/users\/{userId}\/close for each one. The closure path clears the account&#8217;s email address, phone number and nickname, cancels its space subscriptions, removes its space memberships and deletes its OAuth bindings, so the cooling-off window that exists to let a user reverse a deletion request is bypassed and the account cannot be recovered.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12160","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12160","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12160"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12160"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12160"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}