CVE-2026-47388CWE-639

NocoDB: Missing Ownership Check in MCP Attachment Read

Low · published June 23, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
18.4
In the wild
Unconfirmed
What it is

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with knowledge of an attachment path could read any file in shared storage, including attachments belonging to other bases and workspaces, because the MCP readAttachment tool did not verify the file's ownership. This vulnerability is fixed in 2026.05.1.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00271 · 18.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-06-23T20:09Z
EPSS history
Timeline
  • 23 JUN 20:09Z
    NocoDB: Missing Ownership Check in MCP Attachment Read
    cvelistv5