CVE-2026-47387

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore.ts) in NocoDB writes the form's redirect_url to window.location.href after a same-host check that does not validate the URL scheme. A user with editor role (or above) on any base can plant a javascript: URL in the form's redirect_url; when an authenticated viewer opens the share-link and submits the form, the payload executes in the NocoDB origin and can read the session token from localStorage["nocodb-gui-v2"]. This vulnerability is fixed in 2026.05.1.

• CWE-79

• https://github.com/nocodb/nocodb/security/advisories/GHSA-hj85-ph9q-78jg

Published

Jun 23, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47381NocoDB is software for building databases as spreadsheets. P…6.9
• CVE-2026-47382NocoDB is software for building databases as spreadsheets. P…5.3
• CVE-2026-47383NocoDB is software for building databases as spreadsheets. P…7.4
• CVE-2026-47384NocoDB is software for building databases as spreadsheets. P…5.3
• CVE-2026-47385NocoDB is software for building databases as spreadsheets. P…5.3
• CVE-2026-47386NocoDB is software for building databases as spreadsheets. P…6.3
• CVE-2026-47388NocoDB is software for building databases as spreadsheets. P…2.3
• CVE-2026-47389Mastodon is a free, open-source social network server based …8.6
• CVE-2026-4739Integer Overflow or Wraparound vulnerability in InsightSoftw…9.4
• CVE-2026-47390PraisonAI is a multi-agent teams system. Prior to version 4.…5.5
• CVE-2026-47391PraisonAI is a multi-agent teams system. Prior to version 4.…9.8
• CVE-2026-47392PraisonAI is a multi-agent teams system. Prior to version 4.…9.9