CVE-2026-47279CWE-284

NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints

Medium · published June 23, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints accepted a caller-supplied column ID without verifying that the column was visible in the shared view, so anyone holding a share UUID could read links from any LTAR column on the view's table — including columns the view owner had hidden. publicMmList, publicHmList, and relDataList already ensured that the requested column belonged to the view's model, but did not check the view-column entry's show flag. This vulnerability is fixed in 2026.05.1.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00406 · 33.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-06-23T20:18Z
EPSS history
Timeline
  • 23 JUN 20:18Z
    NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints
    cvelistv5