CVE-2026-47378: NocoDB Hidden Column Exposure in Public Shared View Endpoints
Summary
CVE-2026-47378: NocoDB: Hidden Column Exposure in Public Shared View Endpoints. Affects nocodb versions < 2026.04.1. Fixed in 2026.04.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into smart spreadsheets, allowing users to manage data efficiently. It provides features like collaborative editing, data visualization, and integration with various databases. However, a vulnerability has been identified that exposes hidden column values in public shared views, potentially compromising sensitive information.
Vulnerability Detail
The vulnerability arises from public shared-view endpoints that inadvertently expose values from hidden columns. This occurs through three independent paths: groupBy operations returning raw values for hidden columns, filter and sort arrays allowing boolean-blind extraction, and related-data lists accepting arbitrary link-column IDs from other tables. As a result, anyone with access to a shared-view UUID can enumerate hidden-column values, confirm their existence through row counts, or read records from unrelated tables without any authentication.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.04.1
This is the first release that contains the fix.
npm install nocodb@2026.04.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid sharing views that contain hidden columns until the package is updated. Additionally, review and restrict access to shared-view UUIDs to minimize exposure.
Conclusion
The vulnerability CVE-2026-47378 in NocoDB exposes hidden column values through public shared views, posing a risk of unauthorized data access. It is crucial to update to the patched version 2026.04.1 to mitigate this risk and ensure data security.
See every vulnerability recorded for nocodb →
FAQ
The vulnerability allows unauthorized users to access hidden column values in public shared views.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which requires no signup.
The risks include unauthorized access to sensitive data and potential data leakage from unrelated tables.
Yes, the patch is available in version 2026.04.1 of the NocoDB package.
The CVSS score of this vulnerability is 6.9, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
