Executive brief
NocoDB, an open-source platform that turns databases into smart spreadsheets, contained a flaw where public share links granted more permissions than intended. An attacker with access to a shared database link could view the email addresses of other members and invite new users to the database. These invited users could then maintain permanent access to the data even if the original share link was later deleted or revoked.
Technical details
An improper authorization vulnerability (CWE-285) existed in NocoDB where shared-base sessions were incorrectly mapped to the 'ProjectRoles.VIEWER' role. This role was granted 'baseUserList' and 'userInvite' capabilities in the ACL middleware, which failed to distinguish between temporary shared sessions and authenticated viewers. An attacker using only a shared-base UUID could perform a GET request to list base members and a POST request to invite arbitrary email addresses. Once an invited user redeemed the invite through the standard signup flow, they obtained a persistent JWT, effectively bypassing the security controls of the shared link and maintaining access after the link's revocation. This issue is fixed in version 2026.04.1.
Affected products
- NocoDB NocoDB < 2026.04.1
Timeline
- 2026-05-19: advisory: GitHub advisory published
- 2026-04-1: patched: Vulnerability fixed in version 2026.04.1
- 2026-06-23: disclosed: NVD publication date