Incorrect authorization in NocoDB - #VU162875
Published: November 9, 2026
Vulnerability identifier: #VU162875
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker with the Creator role to read and modify NocoDB's internal database records, including user roles.
The vulnerability exists due to data source and base creation endpoints accepting client-controlled is_meta and is_local flags that select the internal database. An authenticated attacker with the Creator role can use base or workspace permissions to expose internal tables in their base, reaching instance-wide metadata on Community edition or Enterprise installations without a separate data database.
Affected software
NocoDB
Remediation
Install security update from vendor's website.
NocoDB - update to 2026.10.0