CVE-2026-47384

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column's title to a SQL fragment. The bulk groupBy path in group-by.ts builds three database-specific knex.raw() aggregations that interpolate the request's column_name directly into the SQL string. Column lookup in data-table.service.ts matches on both the sanitized column_name field and the free-text title, so a title containing a SQL fragment bypasses the public endpoint's existing column allowlist and reaches the query builder unescaped. This vulnerability is fixed in 2026.05.1.

• CWE-89

• https://github.com/nocodb/nocodb/security/advisories/GHSA-p8wx-5f39-w3x4

Published

Jun 23, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47379NocoDB is software for building databases as spreadsheets. P…6.9
• CVE-2026-4738Improper Restriction of Operations within the Bounds of a Me…9.4
• CVE-2026-47380NocoDB is software for building databases as spreadsheets. P…6.3
• CVE-2026-47381NocoDB is software for building databases as spreadsheets. P…6.9
• CVE-2026-47382NocoDB is software for building databases as spreadsheets. P…5.3
• CVE-2026-47383NocoDB is software for building databases as spreadsheets. P…7.4
• CVE-2026-47385NocoDB is software for building databases as spreadsheets. P…5.3
• CVE-2026-47386NocoDB is software for building databases as spreadsheets. P…6.3
• CVE-2026-47387NocoDB is software for building databases as spreadsheets. P…8.4
• CVE-2026-47388NocoDB is software for building databases as spreadsheets. P…2.3
• CVE-2026-47389Mastodon is a free, open-source social network server based …8.6
• CVE-2026-4739Integer Overflow or Wraparound vulnerability in InsightSoftw…9.4