Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

teableio/teable

              develop @ 105e0f9
            

Fixes

CVEs

HIGH

Peak severity

39.5%

Coverage

Highlights

Auth Bypass: 51 prior fixes. Scrutinize any change in this area.

apps/nestjs-backend/src/features/auth/guard/permission.guard.ts: most-fixed (7 issues). Treat as high-risk during review.

41 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Permission validation frequently failed or was bypassed due to inconsistent extraction of resource IDs from route parameters instead of unified contexts, as well as logic flaws in template permission checks and access token scope boundaries.

SQL Injection: Raw string concatenation and improper handling of user-controlled input (such as single quotes and timezone wrap expressions) within the Postgres query builder created critical SQL injection pathways.

Auth Bypass: Missing or isolated authorization contexts within the real-time ShareDB layer allowed users to bypass security policies during socket read/write operations and cross-request memory states.