CVE-2026-47279: NocoDB improper access control in public shared-view relation endpoints

CVE-2026-47279 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw allowed unauthorized individuals with access to a shared view link to see data in columns that the owner had intentionally hidden. This could lead to the exposure of sensitive internal information that was meant to remain private within the database.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-47279 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47279 being exploited in the wild.
How severe is CVE-2026-47279?
Medium severity, with a CVSS score of 4, published 23 June 2026.
Which products and versions are affected?
nocodb (npm) <= 2026.05.0, ECOSYSTEM:introduced=0,fixed=2026.05.1.
Is there a fix for CVE-2026-47279?
Yes. nocodb (npm): upgrade to 2026.05.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47279 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47279?
Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nocodb (npm): upgrade to 2026.05.1 or later
    npm install nocodb@2026.05.1

Technical details

An improper access control vulnerability (CWE-284) exists in NocoDB's public shared-view relation endpoints (publicMmList, publicHmList, and relDataList). While these endpoints verified that a requested column belonged to the table's model, they failed to check the 'show' flag in the view-column configuration. An attacker possessing a valid share UUID could bypass UI-level restrictions by directly calling API endpoints with specific column IDs to retrieve data from hidden Link-To-Another-Record (LTAR) columns. The issue is fixed in version 2026.05.1 by ensuring the API rejects requests for columns where show=false.

Affected products

  • nocodb nocodb < 2026.05.1

Identifiers

  • CVE-2026-47279
  • GHSA-9wgh-m22w-9xj8

Timeline

  • 2026-06-04: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: CVE published to NVD
  • 2026-05-01: patched: Vulnerability fixed in version 2026.05.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.