CVE-2026-46552: NocoDB: Shared-base link access can invite arbitrary users as persistent base members

May 21, 2026 (updated July 20, 2026)

Shared-base sessions were granted the same base-member capabilities as authenticated viewers. Using only the shared-base UUID (xc-shared-base-id), an attacker could enumerate base members and invite an arbitrary email into the base as a real member. The invited user could then redeem the invite via the normal signup flow and retain authenticated access even after the owner revoked the shared link.

References

github.com/advisories/GHSA-chqv-vrj7-qffp
github.com/nocodb/nocodb/security/advisories/GHSA-chqv-vrj7-qffp
nvd.nist.gov/vuln/detail/CVE-2026-46552

Code Behaviors & Features

Detect and mitigate CVE-2026-46552 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →