CVE-2026-46552: NocoDB Authentication Bypass Vulnerability

CVE-2026-46552 Overview

CVE-2026-46552 is an authorization bypass vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. Versions prior to 2026.04.1 granted shared-base sessions the same capabilities as authenticated viewers. An attacker holding only the shared-base UUID (xc-shared-base-id) can enumerate base members and invite arbitrary email addresses into the base as real members. Invited users can redeem the invite through the standard signup flow and retain authenticated access even after the owner revokes the shared link. The flaw is tracked under [CWE-285] (Improper Authorization) and is fixed in NocoDB 2026.04.1.

Critical Impact
Anyone with knowledge of a shared-base UUID can inject persistent authenticated members into a NocoDB base, bypassing the owner's ability to revoke access through link removal.

Affected Products

NocoDB versions prior to 2026.04.1
Self-hosted NocoDB deployments exposing shared-base links
NocoDB instances using the default base-view.strategy authorization mapping

Discovery Timeline

2026-06-23 - CVE-2026-46552 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-46552

Vulnerability Analysis

The vulnerability stems from an authorization model that fails to distinguish anonymous shared-base sessions from authenticated viewers. NocoDB exposes a shared-base feature so external users can browse a base via a UUID-based link without logging in. The backend maps these sessions to the VIEWER project role for read access, but the role itself carries privileges intended only for legitimate authenticated members.

Specifically, packages/nocodb/src/strategies/base-view.strategy/base-view.strategy.ts assigns shared-base requests to ProjectRoles.VIEWER. The access control list in packages/nocodb/src/utils/acl.ts then permits the baseUserList and userInvite actions for that role. The frontend interceptor packages/nc-gui/composables/useApi/interceptors.ts strips authentication headers in favor of the shared-base header, but the server-side middleware applies the same ACL regardless of session origin.

Root Cause

The root cause is missing context propagation in authorization decisions. The strategy reuses the VIEWER role for two distinct trust contexts: authenticated invited viewers and anonymous link visitors. Sensitive management actions such as listing base members and inviting new users were never gated by an additional check that the session originated from an authenticated principal.

Attack Vector

An attacker who obtains a shared-base UUID, through a leaked link, web archive, referrer header, or guessable identifier, can issue API requests carrying the xc-shared-base-id header. Using baseUserList, the attacker enumerates existing collaborators. Using userInvite, the attacker submits an arbitrary email address. The invited account completes the signup flow and becomes a persistent member of the base. Revoking the shared link does not remove the invited account, granting durable unauthorized access to base data.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-chqv-vrj7-qffp for the maintainer's technical write-up.

Detection Methods for CVE-2026-46552

Indicators of Compromise

Unexpected member additions to NocoDB bases without a corresponding owner-initiated invite event
API requests containing the xc-shared-base-id header that target baseUserList or userInvite endpoints
New user signups that redeem invites tied to bases whose shared links were later revoked
Access log entries showing administrative actions originating from requests lacking standard auth headers

Detection Strategies

Audit NocoDB application logs for invocations of userInvite correlated with shared-base session identifiers
Compare current base member rosters against historical baselines to surface unauthorized additions
Alert on any HTTP request to the NocoDB API that carries the shared-base header and a privileged action path
Review reverse proxy logs for high-volume requests against /api/v1/db/meta/projects/*/users from shared-base sessions

Monitoring Recommendations

Forward NocoDB access and application logs to a centralized analytics platform for retention and correlation
Track invite-redemption events and flag accounts created shortly after a shared link was active
Monitor for shared-base UUID exposure across paste sites, public repositories, and search indexes
Establish baseline counts of base members per project and alert on deltas

How to Mitigate CVE-2026-46552

Immediate Actions Required

Upgrade NocoDB to version 2026.04.1 or later without delay
Audit all bases for unexpected members and remove unauthorized accounts
Rotate or revoke all existing shared-base links and reissue them only after patching
Review signup events since the shared-base feature was enabled and disable any suspicious accounts

Patch Information

The vulnerability is fixed in NocoDB 2026.04.1. The fix introduces a distinction between shared-base sessions and authenticated viewer sessions in the ACL evaluation path, removing baseUserList and userInvite capabilities from shared-base contexts. Patch details are documented in the GitHub Security Advisory.

Workarounds

Disable the shared-base feature on all projects until the upgrade is complete
Place NocoDB behind a reverse proxy that strips or rejects the xc-shared-base-id header on routes handling member management
Restrict NocoDB API exposure to trusted networks while the patch is applied
Enforce email allowlists on the NocoDB signup flow to block invites to unknown domains

bash

# Example reverse proxy rule to block shared-base header on management endpoints
location ~* /api/v[0-9]+/db/meta/projects/.*/users {
    if ($http_xc_shared_base_id) {
        return 403;
    }
    proxy_pass http://nocodb_upstream;
}