CVE-2026-46549: NocoDB OAuth Auth Bypass Vulnerability

CVE-2026-46549 Overview

CVE-2026-46549 is an authorization bypass vulnerability in NocoDB, an open-source platform that turns databases into spreadsheets. Versions prior to 2026.04.1 fail to enforce OAuth token scope restrictions in the access control middleware. The OAuth token strategy attaches oauth_scope and oauth_granted_resources to the request user object, but the Access Control List (ACL) middleware never consults either value. Tokens issued with a restricted scope therefore inherit the full permissions of the underlying user. The issue is tracked under CWE-863: Incorrect Authorization and is fixed in NocoDB 2026.04.1.

Critical Impact
An OAuth token restricted to Model Context Protocol (MCP) operations or a specific base can access org-level endpoints with the full privileges of the issuing user, bypassing the intended granted_resources.base_id boundary.

Affected Products

NocoDB versions prior to 2026.04.1
Deployments issuing scoped OAuth tokens (including MCP-only tokens)
Self-hosted NocoDB instances exposing org-level API endpoints

Discovery Timeline

2026-06-23 - CVE-2026-46549 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-46549

Vulnerability Analysis

NocoDB issues OAuth tokens with optional scope and resource restrictions. The token strategy correctly decodes the token and attaches oauth_scope (for example, MCP-only) and oauth_granted_resources (for example, a specific base_id) to the authenticated request user. The ACL middleware, which decides whether a request may proceed, does not read these fields. It only evaluates the underlying user's role and permissions.

The result is broken access control. A token intended to call MCP endpoints against a single base can call any route the user is authorized for, including organization-level endpoints. Because org-level routes do not populate req.context.base_id, the granted_resources.base_id restriction has no enforcement point and is silently ignored.

Root Cause

The root cause is a missing authorization check in the middleware layer. Token metadata describing the intended scope and resource boundaries exists on the request object but is never compared against the route being accessed. This is a classic [CWE-863] incorrect authorization defect where authentication succeeds and the principal is identified, but the policy decision omits a critical attribute.

Attack Vector

An attacker who obtains a scoped OAuth token, or a legitimate integration acting beyond its intent, can send requests to endpoints outside the token's declared scope. Exploitation requires the attacker to already possess a valid scoped token issued for the target user, which is reflected in the high attack complexity and high privileges required in the CVSS vector. The impact is limited to confidentiality of resources reachable by the underlying user account.

No public proof-of-concept code is available. See the GitHub Security Advisory GHSA-m5qg-rvjq-727p for vendor technical details.

Detection Methods for CVE-2026-46549

Indicators of Compromise

OAuth token usage on org-level API routes (for example, /api/v2/meta/... paths) by tokens whose oauth_scope is restricted to MCP or another narrow function.
Requests from a single OAuth token accessing multiple base_id values when the token was issued with a granted_resources.base_id restriction.
Successful HTTP 200 responses on administrative or organization endpoints from integration accounts that historically only call data endpoints.

Detection Strategies

Enable verbose authentication logging in NocoDB and correlate token_id, oauth_scope, and request path. Alert on any path that falls outside the declared scope.
Baseline each OAuth client's normal endpoint set and flag deviations, especially calls to org-level routes by tokens scoped to MCP or a single base.
Review NocoDB audit records for privileged actions performed via OAuth bearer tokens rather than session cookies.

Monitoring Recommendations

Forward NocoDB application and reverse-proxy logs to a centralized logging or SIEM platform and retain at least 90 days of authentication events.
Monitor for spikes in HTTP 200 responses on /users, /orgs, and base-listing endpoints from OAuth clients.
Track newly issued OAuth tokens and reconcile them against approved integrations on a recurring basis.

How to Mitigate CVE-2026-46549

Immediate Actions Required

Upgrade NocoDB to version 2026.04.1 or later, where the ACL middleware enforces oauth_scope and oauth_granted_resources.
Rotate all OAuth tokens issued by vulnerable versions, particularly tokens scoped for MCP or single-base access.
Audit recent activity for any scoped tokens that accessed org-level endpoints or bases outside their declared granted_resources.base_id.

Patch Information

The NocoDB maintainers fixed CVE-2026-46549 in release 2026.04.1. The patch updates the ACL middleware to read oauth_scope and oauth_granted_resources from the request user and deny requests that do not match the token's declared scope or resource set. Patch details and commit references are published in the GitHub Security Advisory GHSA-m5qg-rvjq-727p.

Workarounds

Restrict the underlying user account associated with each OAuth token to the minimum role required, so that scope bypass cannot exceed that user's permissions.
Place a reverse proxy or API gateway in front of NocoDB and explicitly deny org-level routes for OAuth client identifiers that should only call MCP or base-specific endpoints.
Disable issuance of scoped OAuth tokens until the upgrade is complete if scoped tokens are not operationally required.

bash

# Example reverse-proxy rule (nginx) blocking org-level routes for an MCP client
map $http_authorization $is_mcp_token {
    default 0;
    "~*Bearer\s+mcp_"  1;
}

server {
    location ~ ^/api/v2/meta/(orgs|users) {
        if ($is_mcp_token) { return 403; }
        proxy_pass http://nocodb_upstream;
    }
}