Executive brief
NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw allowed users with low-level access tokens to view files and attachments belonging to other workspaces or databases if they knew the file's storage path. This could lead to the unauthorized exposure of sensitive documents or data stored within the platform.
Technical details
An authorization bypass (CWE-639) exists in NocoDB's Model Context Protocol (MCP) implementation. The `readAttachment` tool accepted user-supplied path or URL values and streamed files via the storage adapter without verifying if the file belonged to the requester's specific base or workspace. An attacker with a valid MCP token and knowledge of a specific attachment path could bypass ownership checks to read arbitrary files in shared storage. The vulnerability is resolved in version 2026.05.1 by implementing a lookup in `nc_file_references` to ensure the `base_id` matches the caller's context before streaming.
Affected products
- NocoDB NocoDB < 2026.05.1
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date