CVE-2026-47378
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk15th percentile — higher than 15% of all known CVEs
Summary
NocoDB prior to version 2026.04.1 had a vulnerability that allowed exposure of values from hidden columns in public shared-view endpoints. Users could access these values through various paths, such as groupBy, filter, and sort.
Risk Assessment
Organizations could inadvertently expose sensitive data, leading to potential privacy breaches and data security issues.
Recommendation
It is recommended to update NocoDB to version 2026.04.1 to mitigate this vulnerability and review the configuration of shared-view endpoints to ensure adequate security.
Original NVD description (English source)
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean-blind extraction, and the related-data list accepted arbitrary link-column IDs from other tables in the same base. This vulnerability is fixed in 2026.04.1.