CVE-2026-47378
CVE-2026-47378 · NocoDB: Hidden Column Exposure in Public Shared View Endpoints
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean-blind extraction, and the related-data list accepted arbitrary link-column IDs from other tables in the same base. This vulnerability is fixed in 2026.04.1.
CVSS 6.9 · Media · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node