CVE-2026-47378: NocoDB Information Disclosure Flaw

CVE-2026-47378 Overview

CVE-2026-47378 is an authorization flaw in NocoDB, an open-source platform that turns relational databases into collaborative spreadsheets. Versions prior to 2026.04.1 expose hidden column values through public shared-view endpoints. The flaw maps to [CWE-639: Authorization Bypass Through User-Controlled Key] and stems from missing column-level access checks across three independent code paths. An unauthenticated attacker with a public share link can extract data the view owner intentionally hid from the public view.

Critical Impact
Unauthenticated network attackers can enumerate hidden column values from public NocoDB shared views, defeating the confidentiality boundary the view owner configured.

Affected Products

NocoDB versions prior to 2026.04.1
Public shared-view endpoints (groupBy, filter/sort, related-data list)
Self-hosted and managed NocoDB deployments exposing shared views

Discovery Timeline

2026-06-23 - CVE-2026-47378 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-47378

Vulnerability Analysis

NocoDB allows view owners to publish read-only shared views with selected columns visible to the public. The shared-view backend enforces visibility at the projection layer but does not consistently enforce it on auxiliary query parameters. Prior to 2026.04.1, three endpoints accept column references without validating them against the view's hidden-column list.

The groupBy endpoint returns raw aggregated values for any column name supplied in the request, including columns marked as hidden. This produces direct disclosure of hidden field contents. The filter and sort arrays accept hidden columns as operands, which enables boolean-blind extraction. An attacker submits conditional filters and observes whether records appear in the response, recovering values one predicate at a time. The related-data list endpoint accepts arbitrary link-column identifiers belonging to other tables within the same base, exposing linked records that are not part of the published view.

Root Cause

The shared-view authorization model trusts client-supplied column and link identifiers. Each of the three endpoints resolves the requested column or link directly against the underlying table schema rather than the view's visibility allow list. The result is an Insecure Direct Object Reference at column granularity.

Attack Vector

Exploitation requires only network reachability to a public shared view. The attacker locates a shared view URL, inspects table metadata returned by the share, then issues crafted requests to groupBy, filter, sort, or related-data endpoints referencing the target hidden columns. No authentication, user interaction, or privileges are required. See the GitHub Security Advisory GHSA-4w6r-5c2j-qf5f for endpoint-level technical details.

Detection Methods for CVE-2026-47378

Indicators of Compromise

Repeated requests to shared-view endpoints containing column identifiers that are not part of the visible view projection
High-volume filter or sort requests against the same shared view from a single client, consistent with boolean-blind enumeration
Requests to the related-data list endpoint referencing link-column IDs from tables not exposed by the share

Detection Strategies

Parse NocoDB application logs and reverse-proxy logs for shared-view URLs combined with groupBy, filter, sort, or nested list parameters referencing unknown column IDs
Compare requested column IDs against the view's published column allow list and alert on mismatches
Baseline normal shared-view traffic and flag clients whose request rate or filter permutation count deviates significantly

Monitoring Recommendations

Enable verbose request logging on the NocoDB API gateway, including query strings and JSON bodies for shared endpoints
Forward NocoDB and reverse-proxy logs to a centralized analytics platform for correlation and retention
Alert on bursts of HTTP 200 responses to /api/v1/db/public/shared-view/ paths from a single source address

How to Mitigate CVE-2026-47378

Immediate Actions Required

Upgrade NocoDB to version 2026.04.1 or later on all self-hosted instances
Audit existing public shared views and revoke shares that expose tables containing sensitive hidden columns
Rotate shared-view links after upgrade to invalidate any URLs that may have been harvested

Patch Information

The vulnerability is fixed in NocoDB 2026.04.1. The patch enforces the view's hidden-column allow list across the groupBy, filter, sort, and related-data endpoints. Validate the deployed version with nocodb --version or by checking the container image tag. Refer to the GitHub Security Advisory GHSA-4w6r-5c2j-qf5f for upgrade guidance.

Workarounds

Disable public shared views on tables that contain confidential columns until the upgrade is applied
Place shared-view endpoints behind an authenticated reverse proxy or IP allow list where business requirements permit
Move sensitive fields to a separate base so that link-column traversal from a shared view cannot reach them

bash

# Verify and upgrade a Docker-based NocoDB deployment
docker pull nocodb/nocodb:2026.04.1
docker stop nocodb && docker rm nocodb
docker run -d --name nocodb \
  -p 8080:8080 \
  -v nocodb_data:/usr/app/data \
  nocodb/nocodb:2026.04.1