Auth bypass in Nocodb

CVE-2026-47388

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with knowledge of an attachment path could read any file in shared storage, including attachments belonging to other bases and…

Vulnerability class: IDOR (Insecure Direct Object Reference)

Affected products

  • Nocodb — versions < 2026.05.1

Weakness classification (CWE)

References