Privilege Escalation in NocoDB via OAuth Token Misconfiguration

Executive Summary

This vulnerability exists in NocoDB versions prior to 2026.04.1. The OAuth token strategy attached oauth_scope and oauth_granted_resources to the request user, but the access control middleware did not check these values. As a result, an OAuth token issued with restricted scopes (for example, limited to MCP-only) would still inherit the full permissions of the underlying user across all routes. Additionally, restrictions based on granted_resources.base_id were bypassed on organization-level endpoints that do not populate the base_id in the request context.

This means that the intended access restrictions of OAuth tokens were not enforced properly, allowing tokens to access more resources than they should.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized access where OAuth tokens with restricted scopes gain broader permissions than intended. This could allow an attacker or a compromised token to access or interact with data and resources beyond their authorized scope, potentially exposing sensitive information or allowing unintended actions within the NocoDB environment.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in NocoDB version 2026.04.1. To mitigate this vulnerability, you should upgrade your NocoDB installation to version 2026.04.1 or later.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper enforcement of OAuth token scopes in NocoDB, where OAuth tokens with restricted scopes may inherit full user permissions. Detection involves verifying whether OAuth tokens are being accepted with scopes that should be restricted and checking if org-level endpoints are accessible without proper base/workspace restrictions.

To detect this on your system, you can monitor API requests to org-level endpoints and inspect the OAuth token scopes and granted resources associated with those requests. Look for requests where the OAuth token scope is limited (e.g., MCP-only) but the request is able to access broader resources than allowed.

Suggested commands include capturing and inspecting HTTP requests to NocoDB endpoints using tools like curl or network packet analyzers (e.g., tcpdump, Wireshark) to verify token scopes and access permissions.

• Use curl to make an API request with an OAuth token and check the response for unauthorized access: curl -H "Authorization: Bearer <token>" https://<nocodb-instance>/api/v3/org-level-endpoint
• Use tcpdump or Wireshark to capture traffic and analyze OAuth token scopes in requests to NocoDB endpoints.
• Review server logs for requests where OAuth tokens with restricted scopes are accessing org-level endpoints without base_id restrictions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows OAuth tokens with restricted scopes to inherit full permissions of the underlying user, bypassing intended access controls on organization-level endpoints.

Such unauthorized access could lead to exposure or misuse of sensitive data, potentially impacting compliance with data protection regulations like GDPR and HIPAA that require strict access controls and data minimization.

Useful 0 Not Useful 0