SB20261109116 - Multiple vulnerabilities in NocoDB

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109116

SB20261109116 - Multiple vulnerabilities in NocoDB

Published: November 9, 2026

Security Bulletin ID SB20261109116
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged attacker to read and modify NocoDB's connected database using its data-source connection privileges.

The vulnerability exists due to unvalidated operators in client-supplied formula trees accepted by NocoDB's table-creation API being interpolated into SQL during evaluation. A low-privileged attacker with a base's Creator role can submit a crafted tree without victim interaction to expose user records and tokens and gain super administrator privileges when metadata shares the base's SQLite database.


2) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a highly privileged attacker to read data outside a NocoDB base and slow its database server.

The vulnerability exists due to unescaped backslashes in NocoDB's DATETIME_FORMAT format argument, enabling SQL injection on MySQL or MariaDB with backslash escaping enabled. A highly privileged attacker can create or edit a formula field with a crafted format to execute SQL as the data source's database user when evaluated.


3) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated workspace viewer to claim an invited account and escalate to workspace owner.

The vulnerability exists due to raw invitation tokens being exposed in the workspace member list in affected NocoDB Community Edition deployments outside the official Docker image. An authenticated workspace viewer can retrieve and redeem a token at signup when an unexpired higher-privileged invitation exists, obtaining the invitation's assigned role without proving they are the intended recipient.


4) Weak Password Recovery Mechanism for Forgotten Password (CVE-ID: N/A)

CWE-ID: CWE-640 - Weak password recovery mechanism

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with the base creator role to take over another member's NocoDB account, including a super administrator's.

The vulnerability exists due to unauthorized signup token creation during base invitation resends and token disclosure through member listings when email authentication is enabled. An authenticated attacker with the base creator role can retrieve the token and replace the victim's password without user interaction, gaining the victim's permissions and locking them out.


5) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated attacker to read hidden column values in NocoDB using a shared view link and its password if configured.

The vulnerability exists due to incorrect authorization in the public group-by endpoint when comma-separated column references are checked as one reference rather than individually. An unauthenticated attacker can request a visible column alongside a hidden column to retrieve hidden values for rows permitted by the view's filter.


6) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with the Creator role to read and modify NocoDB's internal database records, including user roles.

The vulnerability exists due to data source and base creation endpoints accepting client-controlled is_meta and is_local flags that select the internal database. An authenticated attacker with the Creator role can use base or workspace permissions to expose internal tables in their base, reaching instance-wide metadata on Community edition or Enterprise installations without a separate data database.


Remediation

Install update from vendor's website.

References