CVE-2026-47378— NocoDB: Hidden Column Exposure in Public Shared View Endpoints
Quick assessment
Affected
nocodb nocodb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NocoDB是nocodb公司开源的一个 Airtable 替代品。将任何 MySql、PostgreSql、Sql Server、Sqlite 和 MariaDb 转换为智能电子表格。 NocoDB 2026.04.1之前版本存在授权问题漏洞，该漏洞源于共享视图端点未对隐藏列值进行保护，通过groupBy、filter、sort数组和相关数据列表三种路径暴露隐藏列数据，可能导致信息泄露。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-47378
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NocoDB: Hidden Column Exposure in Public Shared View Endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean-blind extraction, and the related-data list accepted arbitrary link-column IDs from other tables in the same base. This vulnerability is fixed in 2026.04.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
NocoDB 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NocoDB是nocodb公司开源的一个 Airtable 替代品。将任何 MySql、PostgreSql、Sql Server、Sqlite 和 MariaDb 转换为智能电子表格。 NocoDB 2026.04.1之前版本存在授权问题漏洞，该漏洞源于共享视图端点未对隐藏列值进行保护，通过groupBy、filter、sort数组和相关数据列表三种路径暴露隐藏列数据，可能导致信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-47378
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47378
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-47378 (1)
Same Patch Batch · nocodb · 2026-06-23 · 29 CVEs total
| CVE-2026-46551 | 6.5 MEDIUM | NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk E |
| CVE-2026-46547 | 6.1 MEDIUM | NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL |
| CVE-2026-47375 | 6.0 MEDIUM | NocoDB: Postgres SQL Injection in Formula `ARRAYSORT` |
| CVE-2026-46552 | 5.8 MEDIUM | NocoDB: Shared-base link access can invite arbitrary users as persistent base members |
| CVE-2026-46550 | 5.4 MEDIUM | NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags |
| CVE-2026-46548 | 4.3 MEDIUM | NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost |
| CVE-2026-46549 | 2.0 LOW | NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation |
| CVE-2026-47386 | NocoDB: OAuth Authorization Code Race Condition | |
| CVE-2026-46553 | NocoDB: Attachment Size Limit Bypass via Upload-by-URL | |
| CVE-2026-46554 | NocoDB: Stale Auth Cache After API Token Deletion | |
| CVE-2026-47385 | NocoDB: Path Traversal via SQLite Source Filename | |
| CVE-2026-47382 | NocoDB: Server-Side Request Forgery via Database Connection Host | |
| CVE-2026-47376 | NocoDB: Reflected Cross-Site Scripting via Password Reset Token | |
| CVE-2026-47384 | NocoDB: SQL Injection via Column Title in Bulk GroupBy | |
| CVE-2026-53929 | NocoDB: Stored Cross-Site Scripting via Secure Attachment | |
| CVE-2026-47377 | NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin | |
| CVE-2026-47381 | NocoDB: Cross-Workspace Integration Use in Connection Test | |
| CVE-2026-47379 | NocoDB: Plaintext Password Comparison in Shared Views | |
| CVE-2026-47388 | NocoDB: Missing Ownership Check in MCP Attachment Read | |
| CVE-2026-47387 | NocoDB: Stored Cross-Site Scripting via Form View Redirect URL |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: nocodb
-
CVE-2026-46547
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redi -
CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugi -
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows S -
CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `Secure` and `SameS -
CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users a
Same vendor: nocodb
-
CVE-2026-46547
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redi -
CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugi -
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows S -
CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `Secure` and `SameS -
CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users a
Same weakness: CWE-639
-
CVE-2026-102107
Kiteworks Core user impersonation in a file-request feature -
CVE-2026-102139
Kiteworks Email Protection Gateway Incorrect Authorization -
CVE-2026-103476
yii2-starter-kit through 4.2.0 Unauthorized File Download vi -
CVE-2026-103446
WikiLambda exposes anonymous execution of unsaved Abstract W -
CVE-2026-103233
AdithyaYelloju Restaurant-Management-System Admin Area admin
V. Comments for CVE-2026-47378
No comments yet