Denial of Service Vulnerability in NocoDB by NocoDB Inc.

CVE-2026-46551

What is CVE-2026-46551?

NocoDB, a database software operating with a spreadsheet interface, contains a vulnerability in its v1/v2 attachment API where the uploadViaURL endpoint fails to enforce restrictions on file size. This allows an authenticated user with Editor privileges to exploit the server by prompting it to download overly large files, resulting in significant disk space exhaustion and potential service unavailability. The issue arises because the content-length check is not properly enforced against the defined NC_ATTACHMENT_FIELD_SIZE limit, enabling the download of files beyond the intended capacity. This vulnerability has been addressed in the 2026.04.4 update.

References