CVE-2026-46552

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, shared-base sessions were granted the same base-member capabilities as authenticated viewers. Using only the shared-base UUID (xc-shared-base-id), an attacker could enumerate base members and invite an arbitrary email into the base as a real member. The invited user could then redeem the invite via the normal signup flow and retain authenticated access even after the owner revoked the shared link. Shared-base sessions were mapped to ProjectRoles.VIEWER in packages/nocodb/src/strategies/base-view.strategy/base-view.strategy.ts, and packages/nocodb/src/utils/acl.ts granted baseUserList and userInvite to that role. The shared frontend (packages/nc-gui/composables/useApi/interceptors.ts) deliberately removed auth headers in favour of the shared-base header, but the ACL middleware did not distinguish shared sessions from genuine viewers. This vulnerability is fixed in 2026.04.1.

• CWE-285

• https://github.com/nocodb/nocodb/security/advisories/GHSA-chqv-vrj7-qffp

Published

Jun 23, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46547NocoDB is software for building databases as spreadsheets. P…6.1
• CVE-2026-46548NocoDB is software for building databases as spreadsheets. P…4.3
• CVE-2026-46549NocoDB is software for building databases as spreadsheets. P…2
• CVE-2026-4655The Element Pack Addons for Elementor plugin for WordPress i…6.4
• CVE-2026-46550NocoDB is software for building databases as spreadsheets. P…5.4
• CVE-2026-46551NocoDB is software for building databases as spreadsheets. P…6.5
• CVE-2026-46553NocoDB is software for building databases as spreadsheets. P…2.1
• CVE-2026-46554NocoDB is software for building databases as spreadsheets. P…2.3
• CVE-2026-46555WhatsApp MCP Server is a Model Context Protocol (MCP) server…7.7
• CVE-2026-46556FlaskBB is a Forum Software written in Python using the micr…6.5
• CVE-2026-46557ImageMagick is free and open-source software used for editin…6.2
• CVE-2026-46558Plane is an open-source project management tool. Prior to ve…8.3