PT-2026-46992 · Git+2 · Nocodb
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
NocoDB versions prior to 2026.05.1
Description
Public shared-view relation endpoints fail to verify if a caller-supplied column ID is visible in the shared view. This allows anyone with a share UUID to read links from any LTAR (Link-To-Another-Record) column on the view's table, including columns hidden by the view owner. The issue exists because the functions
publicMmList(), publicHmList(), and relDataList() verified that the column belonged to the view's model but did not check the show flag of the view-column entry.Affected API endpoints include:
- '/api/v2/public/shared-view/:uuid/rows/:rowId/mm/:columnId'
- '/api/v2/public/shared-view/:uuid/rows/:rowId/hm/:columnId'
- '/api/v2/public/shared-view/:uuid/rows/:rowId/{ln,om}/:columnId'
- '/api/v2/public/shared-view/:uuid/nested/:columnId'
Recommendations
Update to version 2026.05.1.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nocodb