SQL Injection in NocoDB Prior to 2026.05.1

Compliance Impact

This SQL injection vulnerability in NocoDB allows an authenticated user with column-create permissions to execute unauthorized SQL queries, potentially leading to unauthorized access to sensitive data stored in the database.

Such unauthorized data access could result in violations of data protection regulations and standards like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

Therefore, if exploited, this vulnerability could compromise compliance by exposing protected data or enabling unauthorized data manipulation.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in NocoDB software versions prior to 2026.05.1. An authenticated user who has permission to create columns can exploit the bulk groupBy endpoint by injecting SQL code through a column's title. The system builds SQL queries by directly inserting the column name into the query string without proper escaping, and because the column title is used in the lookup process, a malicious SQL fragment in the title bypasses the allowlist protections and reaches the query builder unescaped. This can lead to unintended SQL execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated user with limited permissions to perform SQL injection attacks via the bulk groupBy endpoint. This could lead to unauthorized data access, data manipulation, or other unintended database operations, potentially compromising the integrity and confidentiality of the database.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade NocoDB to version 2026.05.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your NocoDB instance is running a version prior to 2026.05.1 and if authenticated users with column-create permissions can set a column's title to a SQL fragment that is then executed in the bulk groupBy endpoint.

To detect potential exploitation attempts or presence of this vulnerability, you can monitor logs for unusual SQL fragments in requests to the bulk groupBy endpoint, especially those involving column title changes.

Since exploitation requires authenticated access with column-create permissions, verifying user permissions and auditing recent column creation or renaming activities can help identify suspicious behavior.

Specific commands depend on your environment, but example approaches include:

• Review web server or application logs for POST requests to the bulk groupBy endpoint containing suspicious SQL fragments in the column title field.
• Use database query logs to detect unusual raw SQL queries that include injected fragments from column titles.
• Run a version check command or query to confirm the NocoDB version, for example by accessing the application info or querying the version endpoint if available.
• Audit user permissions to identify users with column-create rights who might exploit this vulnerability.

Useful 0 Not Useful 0