CVE-2026-47279 Overview
CVE-2026-47279 is a broken access control vulnerability [CWE-284] in NocoDB, an open-source platform for building databases as spreadsheets. The flaw exists in the public shared-view relation endpoints prior to version 2026.05.1. The endpoints publicMmList, publicHmList, and relDataList accept a caller-supplied column ID without verifying the column's visibility in the shared view. Any unauthenticated user holding a share UUID can read links from any Linked-To-Another-Record (LTAR) column on the view's table, including columns the view owner explicitly hid. The vulnerability is fixed in NocoDB 2026.05.1.
Critical Impact
Unauthenticated attackers with a share UUID can disclose hidden LTAR column data from public shared views, breaching the confidentiality boundary the view owner configured.
Affected Products
- NocoDB versions prior to 2026.05.1
- Public shared-view relation endpoints (publicMmList, publicHmList, relDataList)
- Deployments exposing share UUIDs to untrusted users
Discovery Timeline
- 2026-06-23 - CVE-2026-47279 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-47279
Vulnerability Analysis
NocoDB allows view owners to share read-only views via a public share UUID. View owners can hide specific columns from the shared view by setting a show flag to false on the view-column mapping. The vulnerability bypasses this visibility control on relation endpoints that return data from Linked-To-Another-Record (LTAR) columns.
The affected handlers publicMmList, publicHmList, and relDataList perform a partial authorization check. They confirm that the caller-supplied column ID belongs to the view's underlying model. They do not confirm that the corresponding view-column entry has show enabled. An attacker who possesses the share UUID can enumerate column IDs and request relation data from hidden LTAR columns.
Root Cause
The root cause is incomplete enforcement of the view's column visibility policy. Authorization logic validated model membership but omitted the show flag check on the view-column join. This is a classic broken access control pattern in which one of several required checks is missing on a sensitive code path.
Attack Vector
Exploitation requires only network access to the NocoDB instance and possession of a valid public share UUID. The attacker issues requests to the public relation endpoints supplying the target LTAR column ID. The server returns linked-record data even when the column is hidden in the shared view configuration. No authentication, user interaction, or privileges are required.
No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory for technical details.
Detection Methods for CVE-2026-47279
Indicators of Compromise
- Unexpected requests to publicMmList, publicHmList, or relDataList endpoints referencing column IDs not visible in the shared view
- High request volume against public share UUIDs enumerating numeric column identifiers
- Access patterns from unauthenticated clients retrieving relation data shortly after share UUID exposure
Detection Strategies
- Review NocoDB application logs for public relation endpoint calls and correlate column IDs against the view's visible columns
- Alert on parameter fuzzing patterns where a single share UUID is used with many distinct column IDs in a short window
- Inspect reverse proxy or WAF logs for sequential ID enumeration against /api/v1/db/public/ paths
Monitoring Recommendations
- Track all access to public shared-view endpoints with source IP, UUID, and column ID fields
- Baseline normal request rates per share UUID and alert on deviations
- Audit historical logs after upgrade to identify share UUIDs that were likely abused while vulnerable
How to Mitigate CVE-2026-47279
Immediate Actions Required
- Upgrade NocoDB to version 2026.05.1 or later, where the show flag is enforced on relation endpoints
- Rotate or revoke share UUIDs that were active during the vulnerable window, particularly those exposing tables with sensitive hidden columns
- Audit shared views to confirm which columns are hidden and assume any LTAR column data was potentially accessible
Patch Information
The maintainers fixed CVE-2026-47279 in NocoDB 2026.05.1. The patch adds verification that the requested column's view-column entry has the show flag set before returning relation data from publicMmList, publicHmList, and relDataList. See the GitHub Security Advisory GHSA-9wgh-m22w-9xj8 for the upstream advisory.
Workarounds
- Disable public shared views on tables containing sensitive LTAR relationships until the upgrade is applied
- Restrict network access to NocoDB public endpoints via reverse proxy allowlists where feasible
- Remove or replace existing share UUIDs to invalidate links that may have been collected by attackers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
