PT-2026-46996 · Git+2 · Nocodb

0Xbassia · CVE-2026-47378 · Published 2026-06-05 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.04.1

Description Public shared-view endpoints expose values from columns that the view owner had hidden through three independent paths. First, the groupBy function returns raw values for any column named in the request. Second, filter and sort arrays operate on hidden columns, enabling boolean-blind extraction (a technique used to infer data by observing the application's response to true or false queries). Third, the related-data list accepts arbitrary link-column IDs from other tables within the same base. This allows anyone with a shared-view UUID to enumerate hidden-column values, confirm hidden-column values by observing row counts, or read records from unrelated tables in the same base without authentication.

Recommendations Update to version 2026.04.1.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-47378

GHSA-4W6R-5C2J-QF5F

Affected Products

Nocodb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47378.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-47378 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4w6r-5c2j-qf5f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47378 · Security Note
• https://github.com/nocodb/nocodb/security/advisories/GHSA-4w6r-5c2j-qf5f · Note
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/releases/tag/2026.04.1 · Note
• https://t.me/cveNotify/175176 · Telegram Post
• https://t.me/cveNotify/175063 · Telegram Post