PT-2026-42675 · Git+2 · Nocodb

Ik0Z · CVE-2026-46549 · Published 2026-05-21 · Updated 2026-06-24

Positive Technologies (AI Summary)

CVSS v3.1

2.0

Low

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.04.1

Description The OAuth token strategy attaches oauth scope and oauth granted resources to the request user, but the ACL (Access Control List) middleware fails to consult these values. Consequently, an OAuth token issued with a restricted scope inherits the full permissions of the underlying user across all routes. Additionally, the granted resources.base id restriction is bypassed on organization-level endpoints that do not populate req.context.base id. This occurs because the ACL middleware in extract-ids.middleware.ts lacks a gate for is oauth token or scope-string enforcement, allowing tokens scoped to a single base to access organization-level endpoints as the underlying user.

Recommendations Update to version 2026.04.1.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-46549

GHSA-M5QG-RVJQ-727P

Affected Products

Nocodb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46549.json · Exploit
• https://osv.dev/vulnerability/GHSA-m5qg-rvjq-727p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-46549 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46549 · Security Note
• https://github.com/nocodb/nocodb/security/advisories/GHSA-m5qg-rvjq-727p · Note
• https://github.com/nocodb/nocodb · Note
• https://t.me/cveNotify/173589 · Telegram Post
• https://t.me/CVEtracker/57727 · Telegram Post
• https://t.me/cveNotify/173866 · Telegram Post