# CVE-2026-47388: NocoDB authorization bypass in MCP readAttachment tool

Source: https://junglewise.ai/threats/cve-2026-47388-nocodb-authorization-bypass-in-mcp-readattachment-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-47388 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw allowed users with low-level access tokens to view files and attachments belonging to other workspaces or databases if they knew the file's storage path. This could lead to the unauthorized exposure of sensitive documents or data stored within the platform.

Technologies: [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-47388 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47388 being exploited in the wild.

**How severe is CVE-2026-47388?** Medium severity, with a CVSS score of 4, published 23 June 2026.

**Which products and versions are affected?** nocodb (npm) <= 2026.05.0, ECOSYSTEM:introduced=0,fixed=2026.05.1.

**Is there a fix for CVE-2026-47388?** Yes. nocodb (npm): upgrade to 2026.05.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47388 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47388?** Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nocodb (npm): upgrade to 2026.05.1 or later

  ```sh
  npm install nocodb@2026.05.1
  ```


## Technical details

An authorization bypass (CWE-639) exists in NocoDB's Model Context Protocol (MCP) implementation. The `readAttachment` tool accepted user-supplied path or URL values and streamed files via the storage adapter without verifying if the file belonged to the requester's specific base or workspace. An attacker with a valid MCP token and knowledge of a specific attachment path could bypass ownership checks to read arbitrary files in shared storage. The vulnerability is resolved in version 2026.05.1 by implementing a lookup in `nc_file_references` to ensure the `base_id` matches the caller's context before streaming.

## Affected products

- NocoDB NocoDB < 2026.05.1

## Identifiers

- CVE-2026-47388
- GHSA-xxpj-q764-9r6q

## Timeline

- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date

## References

- [https://github.com/nocodb/nocodb/security/advisories/GHSA-xxpj-q764-9r6q](https://github.com/nocodb/nocodb/security/advisories/GHSA-xxpj-q764-9r6q)

## Related threats

- [NocoDB SSRF in spreadsheet-import endpoint](https://junglewise.ai/threats/cve-2026-53931-nocodb-ssrf-in-spreadsheet-import-endpoint)
- [NocoDB SSRF in base-migration endpoint](https://junglewise.ai/threats/cve-2026-53930-nocodb-ssrf-in-base-migration-endpoint)
- [NocoDB stored cross-site scripting in secure attachments](https://junglewise.ai/threats/cve-2026-53929-nocodb-stored-cross-site-scripting-in-secure-attachments)
- [NocoDB insufficient session expiration in password recovery flow](https://junglewise.ai/threats/cve-2026-53928-nocodb-insufficient-session-expiration-in-password-recovery-flow)
- [NocoDB SSRF in spreadsheet-fetch endpoint](https://junglewise.ai/threats/cve-2026-53927-nocodb-ssrf-in-spreadsheet-fetch-endpoint)