CVE-2026-46549: NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation

May 21, 2026 (updated July 20, 2026)

The OAuth token strategy attached oauth_scope and oauth_granted_resources to the request user, but the ACL middleware never consulted either. An OAuth token issued with a restricted scope (e.g. MCP-only) therefore inherited the full permissions of the underlying user across all routes; the granted_resources.base_id restriction was bypassed on org-level endpoints that don’t populate req.context.base_id.

References

github.com/advisories/GHSA-m5qg-rvjq-727p
github.com/nocodb/nocodb/security/advisories/GHSA-m5qg-rvjq-727p
nvd.nist.gov/vuln/detail/CVE-2026-46549

Code Behaviors & Features

Detect and mitigate CVE-2026-46549 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →