Authentication Flaw in NocoDB Database Software

CVE-2026-46552

What is CVE-2026-46552?

NocoDB, a flexible software platform for managing databases as spreadsheets, experienced a significant access control issue prior to version 2026.04.1. The vulnerability allowed unauthorized individuals to gain access to roles and capabilities typically reserved for authenticated users through shared-base sessions. An attacker could use a shared-base UUID to enumerate base members and invite any email address, granting that user full member privileges. This compromise could lead to unauthorized access, as the invited user could maintain access even after the original owner rescinded the shared link. The root cause stemmed from a failure in distinguishing between shared sessions and genuine users, enabling potential exploitation of user roles and permissions.

References