OAuth Token Misconfiguration in NocoDB Software
CVE-2026-46549

2LOW

Key Information:

Vendor

Nocodb

Status
Nocodb
Vendor
CVE Published:
23 June 2026

What is CVE-2026-46549?

NocoDB, a platform that transforms databases into spreadsheet-like interfaces, faced a vulnerability due to an inadequate OAuth token strategy. Prior to version 2026.04.1, the system allowed OAuth tokens with restricted scopes to inherit full permissions of the authenticated user. This flaw occurred because the Access Control List (ACL) middleware did not properly reference the oauth_scope and oauth_granted_resources, leading to potential unauthorized access across all routes. This oversight especially affected organizational-level endpoints that failed to populate the required base_id, circumventing intended restrictions. The vulnerability has been addressed in version 2026.04.1.

Affected Version(s)

nocodb < 2026.04.1

References

https://github.com/nocodb/nocodb/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
2
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.