SQL Injection Vulnerability in NocoBase Plugin Collection by NocoBase
CVE-2026-112306

8.6HIGH

Key Information:

Vendor

Nocobase

Status
Nocobase
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112306?

The NocoBase plugin-collection-sql prior to version 2.2.28 is susceptible to SQL injection, enabling privileged users to exploit the sqlCollection:setFields action. This vulnerability can be exploited to inject unvalidated SQL queries, allowing attackers to potentially access sensitive information, such as database password hashes. By circumventing the checkSQL() function, these malicious commands can be executed upon reloading, significantly compromising the application’s integrity and data security.

Affected Version(s)

nocobase 0 <= 2.2.28

References

https://github.com/nocobase/nocobase/issues/10629
issue-tracking
https://github.com/nocobase/nocobase/blob/v2.2.28/package...
technical-description
https://github.com/nocobase/nocobase
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
Zachariah Mithani
.