Skip to content
OpenAdvisories

Vendor

nocodb

60 known vulnerabilities.

Products

nocodb 52 nocodb/nocodb 8
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 2.0
    CVE-2026-46549

    NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation

    NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the OAuth token strategy attached oauth_scope and oauth_granted_resources to the request user, but the ACL middleware never consulted either. An OAuth token issued with a restricte…

    nocodb nocodb nocodb npm
  • Low 2.1
    CVE-2026-46553

    NocoDB: Attachment Size Limit Bypass via Upload-by-URL

    NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the upload-by-URL path did not enforce NC_ATTACHMENT_FIELD_SIZE against either the remote file's advertised Content-Length or the decoded length of a data: URI, allowing an authent…

    nocodb nocodb nocodb npm
  • Low 2.3
    CVE-2026-46554

    NocoDB: Stale Auth Cache After API Token Deletion

    NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, deleted API tokens continued to authenticate requests until their cache entry expired, because the auth cache was not invalidated by token value at deletion time. The API token del…

    nocodb nocodb nocodb npm
  • Low 2.3
    CVE-2026-47388

    NocoDB: Missing Ownership Check in MCP Attachment Read

    NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with knowledge of an attachment path could read any file in shared storage, including attachments belonging to other bases and workspaces, because …

    nocodb nocodb nocodb npm
  • Low 2.7
    CVE-2026-28360

    NocoDB: Plaintext Storage of Shared View Passwords

    NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3.

    nocodb nocodb nocodb npm
  • Low 2.7
    CVE-2026-28358 Scanner template

    NocoDB: User Enumeration via Password Reset Endpoint

    NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.

    nocodb nocodb nocodb npm