Executive brief
NocoDB is an open-source platform that turns databases into smart spreadsheets for easier data management. A security flaw was found where the system failed to properly restrict what third-party applications (using OAuth tokens) could do. This means a tool granted limited access to a single project could potentially access broader organizational data or perform actions it wasn't supposed to, violating the principle of least privilege.
Technical details
An authorization bypass exists in NocoDB's OAuth token strategy. While the strategy correctly identified 'oauth_scope' and 'oauth_granted_resources', the ACL middleware (specifically in extract-ids.middleware.ts) failed to consult these fields during authorization checks. Consequently, an OAuth token issued with restricted scopes (such as MCP-only) inherited the full role permissions of the associated user across all routes. Furthermore, resource restrictions tied to specific base IDs were bypassed on organization-level endpoints where the request context did not explicitly populate a base ID. The fix introduces a path-prefix allowlist and a 'blockOAuthTokenAccess' flag for sensitive endpoints.
Affected products
- NocoDB NocoDB < 2026.04.1
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date
- 2026-04-01: patched: Fixed in version 2026.04.1