Generation of Predictable Numbers or Identifiers in NocoDB - #VU162862
Published: November 9, 2026
Vulnerability identifier: #VU162862
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-340
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read NocoDB data exports, including fields hidden from public shared views.
The vulnerability exists due to predictable export paths served without authentication after a member exports data on installations using local storage with NC_SECURE_ATTACHMENTS disabled. An unauthenticated remote attacker can reconstruct an export path using the table identifier, base, table and view titles, and export time to download the file without a signed link.
Affected software
NocoDB
Remediation
Install security update from vendor's website.
NocoDB - update to 2026.10.1