CVE-2026-47378
CVE-2026-47378 · NocoDB: Hidden Column Exposure in Public Shared View Endpoints
This page contains facts from public vulnerability sources. Check the original advisory before updating.
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean-blind extraction, and the related-data list accepted arbitrary link-column IDs from other tables in the same base. This vulnerability is fixed in 2026.04.1.
CVSS 6.9 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node