SB2026060528 - Multiple vulnerabilities in NocoDB
Published: June 5, 2026 Updated: November 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-47279)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in public shared-view relation endpoints. A remote attacker can bypass implemented security restrictions and read links from any LTAR column on the view's table.
2) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-47381)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to cross-workspace integration use in Connection Test. A remote user can gain access to sensitive information on the system.
3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-47382)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input in database connection host. A remote user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
4) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-47388)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to authorization bypass through user-controlled key in MCP attachment read. A remote user can read any file in shared storage.
5) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-47379)
CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to plaintext password comparison in Shared Views. A remote attacker can mount a timing oracle against shared views whose passwords predated the bcrypt migration.
6) Stored cross-site scripting (CVE-ID: CVE-2026-47387)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in form view redirect URL. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
7) SQL injection (CVE-ID: CVE-2026-47384)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data within column title in bulk groupBy. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
8) Insufficient Session Expiration (CVE-ID: CVE-2026-53926)
CWE-ID: CWE-613 - Insufficient Session Expiration
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient session expiration issue. A remote user can gain persistent access through previously issued OAuth tokens after a documented security event.
9) Race condition (CVE-ID: CVE-2026-47386)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to a race condition within the same OAuth authorization code. A remote attacker can obtain a long-lived refresh token in addition to the legitimate one.
10) Path traversal (CVE-ID: CVE-2026-47385)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences within SQLite source filename. A remote attacker can send a specially crafted HTTP request and read or overwrite arbitrary files on the system.
11) Stored cross-site scripting (CVE-ID: CVE-2026-47383)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in row comments. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
12) Insufficient Session Expiration (CVE-ID: CVE-2026-53928)
CWE-ID: CWE-613 - Insufficient Session Expiration
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a low-privileged remote attacker with a stolen refresh cookie to retain unauthorized access to a victim's NocoDB account after password recovery.
The vulnerability exists due to insufficient session expiration in NocoDB's forgot-password flow, which leaves existing refresh tokens valid when the victim initiates recovery. A low-privileged remote attacker can exchange the captured refresh cookie for new access tokens and continue accessing the victim's account.
13) Cross-site scripting (CVE-ID: CVE-2026-53929)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows an authenticated attacker with upload permission to execute stored cross-site scripting in the NocoDB origin and read a victim's authentication JWT.
The vulnerability exists due to a response-header key mismatch that prevents download enforcement in NocoDB's signed attachment handler when NC_SECURE_ATTACHMENTS=true is enabled. An authenticated attacker with upload permission can upload malicious HTML or SVG attachments that execute scripts when a victim opens them in a browser.
14) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-53930)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a workspace owner to make NocoDB's migration worker read local files or contact non-HTTP services.
The vulnerability exists due to missing URL protocol validation in the base-migration endpoint when processing a caller-supplied migration URL. A workspace owner can submit a URL using a non-HTTP scheme to cause the server to access local resources through the migration worker.
15) Unintended Proxy or Intermediary (CVE-ID: CVE-2026-53931)
CWE-ID: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to use NocoDB as an HTTP proxy to reach internal services accessible from its host.
The vulnerability exists due to missing authentication and full-URL extension validation in the spreadsheet import endpoint, which accepts a spreadsheet extension in a URL query string. An unauthenticated remote attacker can append a .csv query suffix to a target URL and cause the server to request a non-spreadsheet resource.
16) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-53927)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose cloud metadata, credentials, and internal HTTP responses accessible to the NocoDB process.
The vulnerability exists due to permissive extension matching and an incomplete IP blocklist in NocoDB's axiosRequestMake endpoint when validating spreadsheet-fetch URLs, enabling server-side request forgery. A remote user can submit a crafted URL such as http://169.254.169.254/credentials/.xlsx through spreadsheet import with editor permission to retrieve sensitive internal data.
Remediation
Install update from vendor's website.
References
- https://github.com/nocodb/nocodb/security/advisories/GHSA-9wgh-m22w-9xj8
- https://github.com/nocodb/nocodb/security/advisories/GHSA-96fh-m4r8-6v9v
- https://github.com/nocodb/nocodb/security/advisories/GHSA-w43h-r5m5-p832
- https://github.com/nocodb/nocodb/security/advisories/GHSA-xxpj-q764-9r6q
- https://github.com/nocodb/nocodb/security/advisories/GHSA-qhxg-623c-cfjm
- https://github.com/nocodb/nocodb/security/advisories/GHSA-hj85-ph9q-78jg
- https://github.com/nocodb/nocodb/security/advisories/GHSA-p8wx-5f39-w3x4
- https://github.com/nocodb/nocodb/security/advisories/GHSA-g72g-r7m4-9x4g
- https://github.com/nocodb/nocodb/security/advisories/GHSA-8m7c-hf24-5g47
- https://github.com/nocodb/nocodb/security/advisories/GHSA-wvqj-9wv4-7ff5
- https://github.com/nocodb/nocodb/security/advisories/GHSA-jf3g-4gwg-4h66
- https://github.com/nocodb/nocodb/security/advisories/GHSA-r989-7g3j-wjhw
- https://github.com/nocodb/nocodb/security/advisories/GHSA-6mhr-74x2-98v9
- https://github.com/nocodb/nocodb/security/advisories/GHSA-h6vv-pcq8-7xm4
- https://github.com/nocodb/nocodb/security/advisories/GHSA-hmcr-rmjq-47qr
- https://github.com/nocodb/nocodb/security/advisories/GHSA-gprh-27j3-g5h4