SQL Injection Vulnerability in NocoBase AI-Powered Platform
CVE-2026-52887

10CRITICAL

Key Information:

Vendor

Nocobase

Status
Nocobase
Vendor
CVE Published:
15 July 2026

What is CVE-2026-52887?

NocoBase, an AI-powered no-code/low-code platform, has a vulnerability in versions prior to 2.0.61 due to an improper handling of input parameters in the notification API. The GET request to /api/myInAppChannels:list allows authenticated users to inject unvalidated input into SQL commands. This oversight could enable attackers to execute arbitrary PostgreSQL commands and potentially gain unauthorized access to sensitive data. The issue is remediated in version 2.0.61.

Affected Version(s)

nocobase < 2.0.61

References

https://github.com/nocobase/nocobase/security/advisories/...
x_refsource_CONFIRM
https://github.com/nocobase/nocobase/commit/68d64e3fcfb8b...
x_refsource_MISC
https://github.com/nocobase/nocobase/releases/tag/v2.0.61
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.