CVE-2026-47381

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1

Description A user in one workspace can exercise another workspace's integration by supplying its ID to the 'testConnection' endpoint. This occurs because the integration is fetched in a bypass scope, and the permission check only verifies if the caller holds an owner or creator role on any base in any workspace, rather than restricting the check to the specific workspace of the integration. This allows cross-tenant access to integration configurations and the ability to operate the resolved database using another workspace's credentials.

Recommendations Update to version 2026.05.1.