CVE-2026-47381: NocoDB: Cross-Workspace Integration Use in Connection Test

June 5, 2026 (updated July 20, 2026)

A user in one workspace could exercise another workspace’s integration through the testConnection endpoint by supplying its ID, because the integration was fetched in a bypass scope and the caller’s permission check matched any base in any workspace.

References

github.com/advisories/GHSA-96fh-m4r8-6v9v
github.com/nocodb/nocodb/releases/tag/2026.05.1
github.com/nocodb/nocodb/security/advisories/GHSA-96fh-m4r8-6v9v
nvd.nist.gov/vuln/detail/CVE-2026-47381

Code Behaviors & Features

Detect and mitigate CVE-2026-47381 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →