Description
NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nocodb | nocodb | < 2026.09.0 | 2026.09.0 |
References
- GitHub Security Advisory (GHSA-x3xv-qpw2-33x6) vendor-advisory
- VulnCheck Advisory: NocoDB before 2026.09.0 IDOR in Row Comment Operations third-party-advisory