CVE-2026-47381: NocoDB authorization bypass in testConnection endpoint

CVE-2026-47381 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB is an open-source platform that turns databases into smart spreadsheets for business collaboration. A security flaw allowed users in one workspace to access and test database connections belonging to other organizations or teams by simply providing the connection ID. This could allow an unauthorized user to verify and potentially interact with external database integrations they do not own, compromising the isolation between different customers or departments.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-47381 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47381 being exploited in the wild.
How severe is CVE-2026-47381?
Medium severity, with a CVSS score of 4, published 23 June 2026.
Which products and versions are affected?
nocodb (npm) <= 2026.05.0, ECOSYSTEM:introduced=0,fixed=2026.05.1.
Is there a fix for CVE-2026-47381?
Yes. nocodb (npm): upgrade to 2026.05.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47381 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47381?
Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nocodb (npm): upgrade to 2026.05.1 or later
    npm install nocodb@2026.05.1

Technical details

An authorization bypass vulnerability exists in NocoDB's 'testConnection' endpoint. The root cause is that the endpoint fetched integration details using 'RootScopes.BYPASS' and performed a permission check that only verified if the caller held an owner or creator role on any base in any workspace, rather than the specific workspace owning the integration. An attacker with creator/owner permissions in their own workspace could trigger connection tests for integrations in other workspaces by supplying the target integration ID. This allows cross-tenant access to integration configurations and the ability to exercise database credentials belonging to other workspaces. The issue is resolved in version 2026.05.1 by scoping permission lookups to the integration's specific workspace ID.

Affected products

  • nocodb NocoDB < 2026.05.1

Identifiers

  • CVE-2026-47381
  • GHSA-96fh-m4r8-6v9v

Timeline

  • 2026-06-04: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: CVE published to NVD
  • 2026-05-01: patched: Fixed in version 2026.05.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.