CVE Vulnerability Catalog

NocoDB prior to version 2026.05.1 allowed authenticated uploaders to deliver .html or .svg attachments that were rendered inline in the browser instead of forcing a download. The issue stemmed from a mismatch in how response headers were handled, leading to automatic rendering of these files.

NocoDB prior to version 2026.05.1 had a vulnerability where a stolen refresh token could be used to mint new JWTs even after the user reset their password. The password forgot flow did not delete all refresh tokens, allowing an attacker to exchange the captured token for a new access token.

NocoDB prior to version 2026.05.1 had a vulnerability in the spreadsheet-fetch endpoint (axiosRequestMake) that accepted URLs with a permitted extension anywhere in the string. This allowed access to the cloud-metadata endpoint via a crafted URL.

NocoDB prior to version 2026.05.1 had a vulnerability in the users service where the revokeAllOAuthTokensByUser function was an empty stub. As a result, OAuth tokens were not revoked when the user changed, reset, or recovered their password.

NocoDB prior to version 2026.05.1 had a vulnerability that allowed two concurrent uses of the same OAuth authorization code to generate two distinct valid (access_token, refresh_token) pairs. This broke the single-use guarantee that PKCE relies on.

NocoDB prior to version 2026.05.1 allowed authenticated users with base-create permissions to attach a SQLite source pointing at any file on the NocoDB host, including NocoDB's internal databases. Users could point to noco.db or other databases, enabling them to read or overwrite their contents.

NocoDB prior to version 2026.05.1 allows authenticated users with column-create permission to inject SQL into the bulk groupBy endpoint. This can be achieved by setting a column's title to a SQL fragment, bypassing the existing column allowlist.

NocoDB prior to version 2026.05.1 had a vulnerability that allowed opening a raw TCP socket to a user-supplied database host without validating the destination address. This enabled access to private and link-local addresses, including localhost.

NocoDB prior to version 2026.05.1 allowed users in one workspace to access another workspace's integration through the testConnection endpoint by supplying its ID. The issue stemmed from improper permission checks, enabling unauthorized access.

NocoDB prior to version 2026.04.1 had an issue with differing sign-in response times based on whether the email address was known or unknown. The unknown-user branch returned without performing a password hash comparison, creating a security vulnerability.

NocoDB prior to version 2026.05.1 had an issue with password verification in shared-view mode, leading to leakage of the password's length and character prefix through response timing. This vulnerability has been fixed in version 2026.05.1.

NocoDB prior to version 2026.04.1 had a vulnerability that allowed exposure of values from hidden columns in public shared-view endpoints. Users could access these values through various paths, such as groupBy, filter, and sort.

NocoDB prior to version 2026.04.1 had a vulnerability in the hashRedirect plugin that allowed redirecting users to malicious sites. The redirection occurred after checking if the path starts with '/', which allowed the use of protocol-relative URLs.

NocoDB prior to version 2026.04.1 had a vulnerability in the password-reset page that rendered the URL token directly into JavaScript string literals. A crafted token could break out of the JS string context and execute attacker-controlled script.

NocoDB prior to version 2026.04.1 allows an authenticated user with columnAdd permission to inject arbitrary SQL into the formula engine via the direction argument of ARRAYSORT(...). The value is unrestricted by formula validation and embedded into a knex.raw ORDER BY clause, executing during column creation and on every subsequent record read of the formula column.

NocoDB prior to version 2026.05.1 had a vulnerability that allowed access to hidden columns in shared views. Public relation endpoints accepted a caller-supplied column ID without verifying if the column was visible in the shared view.

NocoDB prior to version 2026.04.1 had a vulnerability that allowed attackers to access database members through the shared-base session UUID. Attackers could invite arbitrary email addresses as real members of the base, leading to unauthorized access.

NocoDB prior to version 2026.04.4 had a vulnerability in the attachment API that allowed authenticated users to download arbitrarily large files, leading to disk space exhaustion and denial of service.

NocoDB prior to version 2026.04.1 had a security vulnerability related to the refresh-token cookie, which was set with httpOnly: true but lacked both the secure flag and the sameSite attribute. This allowed the cookie to be intercepted on the network and enabled CSRF attacks against the token-refresh endpoint.

NocoDB prior to version 2026.04.1 had non-functional SSRF protection in four notification webhook plugins (Slack, Discord, Mattermost, Teams). An authenticated user with hook-creation permission could direct outbound POST requests to arbitrary internal hosts.