CVE-2026-47378: NocoDB: Hidden Column Exposure in Public Shared View Endpoints

June 5, 2026 (updated July 20, 2026)

Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean-blind extraction, and the related-data list accepted arbitrary link-column IDs from other tables in the same base.

References

github.com/advisories/GHSA-4w6r-5c2j-qf5f
github.com/nocodb/nocodb/releases/tag/2026.04.1
github.com/nocodb/nocodb/security/advisories/GHSA-4w6r-5c2j-qf5f
nvd.nist.gov/vuln/detail/CVE-2026-47378

Code Behaviors & Features

Detect and mitigate CVE-2026-47378 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →