SQL injection in NocoDB - #VU162860
Published: November 9, 2026
Vulnerability identifier: #VU162860
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged attacker to read and modify NocoDB's connected database using its data-source connection privileges.
The vulnerability exists due to unvalidated operators in client-supplied formula trees accepted by NocoDB's table-creation API being interpolated into SQL during evaluation. A low-privileged attacker with a base's Creator role can submit a crafted tree without victim interaction to expose user records and tokens and gain super administrator privileges when metadata shares the base's SQLite database.
Affected software
NocoDB
Remediation
Install security update from vendor's website.
NocoDB - update to 2026.10.0