Information Disclosure in NocoDB Prior to 2026.05.1

Executive Summary

This vulnerability exists in NocoDB versions prior to 2026.05.1. The issue is that the public shared-view relation endpoints accepted a column ID supplied by the caller without verifying if that column was actually visible in the shared view. As a result, anyone with access to the share UUID could read data from any LTAR column in the table, including columns that the view owner had intentionally hidden.

While some lists like publicMmList, publicHmList, and relDataList ensured the requested column belonged to the view's model, they did not check whether the column was marked as visible (the 'show' flag) in the view-column entry. This allowed unauthorized access to hidden columns.

This vulnerability was fixed in version 2026.05.1 of NocoDB.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of data. Specifically, an attacker who has the share UUID can access and read data from columns that were meant to be hidden by the view owner. This could expose sensitive or confidential information that was not intended to be shared publicly.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade NocoDB to version 2026.05.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized access to hidden columns in shared views of NocoDB, potentially exposing sensitive or restricted data to anyone with a share UUID.

Such unauthorized data exposure could lead to non-compliance with data protection regulations and standards like GDPR and HIPAA, which require strict access controls and protection of personal or sensitive information.

By allowing access to hidden data without proper verification, the vulnerability undermines confidentiality and access control requirements mandated by these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized access to hidden LTAR columns via specific public shared-view relation endpoints in NocoDB. To detect exploitation attempts on your network or system, you can monitor HTTP requests targeting these endpoints with unusual or unauthorized column IDs.

• Check for GET requests to endpoints such as /api/v2/public/shared-view/:uuid/rows/:rowId/mm/:columnId, /hm/:columnId, /{ln,om}/:columnId, and /nested/:columnId.
• Look for requests where the columnId parameter corresponds to columns that should be hidden or inaccessible in the shared view.

Example command to search web server logs for suspicious access attempts (assuming logs are in access.log):

• grep -E "/api/v2/public/shared-view/.+/rows/.+/(mm|hm|ln|om)/.+" access.log
• grep -E "/api/v2/public/shared-view/.+/nested/.+" access.log

Further analysis can be done by correlating these requests with user activity or share UUIDs to identify unauthorized data access attempts.

Useful 0 Not Useful 0