Is CVE-2026-47378 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47378 being exploited in the wild.

How severe is CVE-2026-47378?

Medium severity, with a CVSS score of 4, published 23 June 2026.

Which products and versions are affected?

nocodb (npm) < 2026.04.1, ECOSYSTEM:introduced=0,fixed=2026.04.1.

Is there a fix for CVE-2026-47378?

Yes. nocodb (npm): upgrade to 2026.04.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47378 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-47378?

Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47378: NocoDB information disclosure in public shared-view endpoints

Q: Which products and versions are affected?

nocodb (npm) < 2026.04.1, ECOSYSTEM:introduced=0,fixed=2026.04.1.

Q: Is there a fix for CVE-2026-47378?

Yes. nocodb (npm): upgrade to 2026.04.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47378 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-47378?

Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47378 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB is a self-hosted database management tool similar to Airtable. Organizations sharing database views with specific people or external stakeholders intended to hide certain columns from those shared views, but a design flaw allowed anyone with the shared view's UUID to bypass those restrictions. An attacker could directly read hidden columns, infer hidden data by observing row counts in filtered results, and access data from completely separate tables within the same database—all without needing to log in.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-47378 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47378 being exploited in the wild.
How severe is CVE-2026-47378?: Medium severity, with a CVSS score of 4, published 23 June 2026.
Which products and versions are affected?: nocodb (npm) < 2026.04.1, ECOSYSTEM:introduced=0,fixed=2026.04.1.
Is there a fix for CVE-2026-47378?: Yes. nocodb (npm): upgrade to 2026.04.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47378 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-47378?: Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nocodb (npm): upgrade to 2026.04.1 or later
```
npm install nocodb@2026.04.1
```

Technical details

The vulnerability stems from insufficient input validation in three independent code paths handling public shared-view requests. The groupBy endpoint fails to validate that requested column names exist in the visible column set, allowing direct enumeration. The filter and sort functionality operates on column references (fk_column_id) without checking visibility, enabling boolean-blind information disclosure. The related-data list endpoint accepts arbitrary link-column IDs without verifying the target table belongs to the current model, allowing cross-table data access. Attack preconditions require only possession of a valid shared-view UUID; no authentication or user interaction is needed. The fix (v2026.04.1) introduces sanitizeListArgsForPublicView to strip unsafe request keys, validates filter/sort operations against visible columns only, and enforces table-ownership checks on related-data resolution. CWE-639 (Authorization Bypass Through User-Controlled Key).

Affected products

NocoDB nocodb < 2026.04.1

Identifiers

CVE-2026-47378
GHSA-4w6r-5c2j-qf5f

Timeline

2026-06-05: disclosed: GHSA advisory published
2026-04-01: patched: Fix released in version 2026.04.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.