GHSA-4w6r-5c2j-qf5f CVE-2026-47378

NocoDB: Hidden Column Exposure in Public Shared View Endpoints

Medium npm

Severity: 0.0 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): 0.41%; Chance of exploitation in the next 30 days. Higher than 34.83% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-639 Authorization Bypass Through User-Controlled Key
Fix: 2026.04.1; Upgrade nocodb to this version or later

Description

Summary

Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean-blind extraction, and the related-data list accepted arbitrary link-column IDs from other tables in the same base.

Details

A new sanitizeListArgsForPublicView helper now strips request keys that should never be caller-controlled (e.g. getHiddenColumn, nested), parses where clauses against a restricted alias map that only contains visible columns, and recursively removes filter/sort entries whose fk_column_id is not in the visible set. validateGroupByColumnNames and validateGroupColumnId reject groupBy requests whose column_name (CSV-style) or groupColumnId is not in the visible or group-by column set. relDataList now checks column.fk_model_id === currentModel.id before resolving the linked table, matching the pre-existing check on publicMmList and publicHmList.

Impact

Anyone with a shared-view UUID could enumerate hidden-column values directly (via groupBy), confirm hidden-column values by observing row counts (via filter), or read records from unrelated tables in the same base (via the related-data list). No authentication was required.

Credit

This issue was reported by @0xBassia. It was independently reported by @b-hermes.

Affected versions

npm

Package	Vulnerable	Fixed in
nocodb	`< 2026.04.1`	`2026.04.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

nocodb npm → `2026.04.1`

npm

npm install nocodb@2026.04.1

yarn

yarn add nocodb@2026.04.1

pnpm

pnpm add nocodb@2026.04.1

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): Low
Integrity (vulnerable system): None
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

Weakness

CWE-639: Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

How to prevent it

Architecture and Design: For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Architecture and Design, Implementation: Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Architecture and Design: Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-47378

Packages

github.com/nocodb/nocodb

Timeline

Jun 5, 2026 Published
Jul 20, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-hmcr-rmjq-47qr NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint	Medium	Also affects nocodb
GHSA-h6vv-pcq8-7xm4 NocoDB: Server-Side Request Forgery via Base Migration URL	Medium	Also affects nocodb
GHSA-6mhr-74x2-98v9 NocoDB: Stored Cross-Site Scripting via Secure Attachment	Medium	Also affects nocodb
GHSA-r989-7g3j-wjhw NocoDB: Refresh Tokens Persist Through Password Recovery	Medium	Also affects nocodb
GHSA-gprh-27j3-g5h4 NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL	Medium	Also affects nocodb
GHSA-g72g-r7m4-9x4g NocoDB: OAuth Tokens Persist Through Security Events	Medium	Also affects nocodb
GHSA-xxpj-q764-9r6q NocoDB: Missing Ownership Check in MCP Attachment Read	Low	Also affects nocodb
GHSA-hj85-ph9q-78jg NocoDB: Stored Cross-Site Scripting via Form View Redirect URL	High	Also affects nocodb

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor