# CVE-2026-46552: NocoDB improper authorization in shared-base sessions

Source: https://junglewise.ai/threats/cve-2026-46552-nocodb-improper-authorization-in-shared-base-sessions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-46552 · Severity: medium · CVSS 5.8 · Published 2026-06-23

NocoDB, an open-source platform that turns databases into smart spreadsheets, contained a flaw where public share links granted more permissions than intended. An attacker with access to a shared database link could view the email addresses of other members and invite new users to the database. These invited users could then maintain permanent access to the data even if the original share link was later deleted or revoked.

Technologies: [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-46552 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46552 being exploited in the wild.

**How severe is CVE-2026-46552?** Medium severity, with a CVSS score of 5.8, published 23 June 2026.

**Which products and versions are affected?** nocodb (npm) <= 0.301.3, SEMVER:introduced=0,last_affected=0.301.3.

**Is there a fix for CVE-2026-46552?** A patch was published on 2026-04-1: Vulnerability fixed in version 2026.04.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46552 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46552?** Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authorization vulnerability (CWE-285) existed in NocoDB where shared-base sessions were incorrectly mapped to the 'ProjectRoles.VIEWER' role. This role was granted 'baseUserList' and 'userInvite' capabilities in the ACL middleware, which failed to distinguish between temporary shared sessions and authenticated viewers. An attacker using only a shared-base UUID could perform a GET request to list base members and a POST request to invite arbitrary email addresses. Once an invited user redeemed the invite through the standard signup flow, they obtained a persistent JWT, effectively bypassing the security controls of the shared link and maintaining access after the link's revocation. This issue is fixed in version 2026.04.1.

## Affected products

- NocoDB NocoDB < 2026.04.1

## Identifiers

- CVE-2026-46552
- GHSA-chqv-vrj7-qffp

## Timeline

- 2026-05-19: advisory: GitHub advisory published
- 2026-04-1: patched: Vulnerability fixed in version 2026.04.1
- 2026-06-23: disclosed: NVD publication date

## References

- [https://github.com/nocodb/nocodb/security/advisories/GHSA-chqv-vrj7-qffp](https://github.com/nocodb/nocodb/security/advisories/GHSA-chqv-vrj7-qffp)

## Related threats

- [NocoDB SSRF in spreadsheet-import endpoint](https://junglewise.ai/threats/cve-2026-53931-nocodb-ssrf-in-spreadsheet-import-endpoint)
- [NocoDB SSRF in base-migration endpoint](https://junglewise.ai/threats/cve-2026-53930-nocodb-ssrf-in-base-migration-endpoint)
- [NocoDB stored cross-site scripting in secure attachments](https://junglewise.ai/threats/cve-2026-53929-nocodb-stored-cross-site-scripting-in-secure-attachments)
- [NocoDB insufficient session expiration in password recovery flow](https://junglewise.ai/threats/cve-2026-53928-nocodb-insufficient-session-expiration-in-password-recovery-flow)
- [NocoDB SSRF in spreadsheet-fetch endpoint](https://junglewise.ai/threats/cve-2026-53927-nocodb-ssrf-in-spreadsheet-fetch-endpoint)