CVE-2026-47378

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.04.1

Description Public shared-view endpoints expose values from columns that the view owner had hidden through three independent paths. First, the groupBy function returns raw values for any column named in the request. Second, filter and sort arrays operate on hidden columns, enabling boolean-blind extraction (a technique used to infer data by observing the application's response to true or false queries). Third, the related-data list accepts arbitrary link-column IDs from other tables within the same base. This allows anyone with a shared-view UUID to enumerate hidden-column values, confirm hidden-column values by observing row counts, or read records from unrelated tables in the same base without authentication.

Recommendations Update to version 2026.04.1.