CVE-2026-47378
CVE-2026-47378 · NocoDB: Hidden Column Exposure in Public Shared View Endpoints
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean-blind extraction, and the related-data list accepted arbitrary link-column IDs from other tables in the same base. This vulnerability is fixed in 2026.04.1.
CVSS 6.9 · Mittel · EPSS 0,4% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: node