Executive brief
NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw allowed unauthorized individuals with access to a shared view link to see data in columns that the owner had intentionally hidden. This could lead to the exposure of sensitive internal information that was meant to remain private within the database.
Technical details
An improper access control vulnerability (CWE-284) exists in NocoDB's public shared-view relation endpoints (publicMmList, publicHmList, and relDataList). While these endpoints verified that a requested column belonged to the table's model, they failed to check the 'show' flag in the view-column configuration. An attacker possessing a valid share UUID could bypass UI-level restrictions by directly calling API endpoints with specific column IDs to retrieve data from hidden Link-To-Another-Record (LTAR) columns. The issue is fixed in version 2026.05.1 by ensuring the API rejects requests for columns where show=false.
Affected products
- nocodb nocodb < 2026.05.1
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD
- 2026-05-01: patched: Vulnerability fixed in version 2026.05.1