A critical authentication bypass vulnerability in APITable allows unauthenticated remote attackers to permanently delete user accounts by exploiting improperly configured internal API endpoints.

The application incorrectly annotates internal controller methods with requiredLogin = false, causing the ResourceInterceptor to skip session validation. This allows any unauthenticated user to access the getUserHistories and closePausedUserAccount endpoints to manipulate user account deletion states.

Successful exploitation allows an attacker to bypass the 30-day cooling-off period designed to protect users from accidental account deletion. By enumerating and forcibly closing accounts, an attacker can cause permanent data loss, unauthorized service disruption for users, and significant reputational damage to the platform provider. The CVSS score of 8.2 reflects the high impact on data integrity and the ability for remote, unauthenticated actors to execute destructive administrative actions.

Immediate Action: Upgrade to the latest version of APITable once a patch is released, as version 1.13.0-beta.1 and earlier are confirmed vulnerable.

Proactive Monitoring: Review web server and application logs for anomalous POST requests directed at /api/v1/internal/getUserHistories or /api/v1/internal/users/{userId}/close from unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or restrict public access to the /api/v1/internal/ path, ensuring these administrative endpoints are only reachable from trusted internal networks.

Public Exploit Available: Unknown

Given the severity of this vulnerability and the potential for permanent data destruction, organizations using APITable must prioritize restricting access to internal API endpoints immediately. Administrators should monitor the project repository for the release of a security patch and apply it as soon as it becomes available to ensure the integrity of the user account management system.