Executive Summary

This vulnerability exists in NocoDB versions prior to 2026.05.1 in the shared form-view submit handler. The handler writes the form's redirect_url to window.location.href after performing a same-host check that does not validate the URL scheme.

A user with an editor role or higher on any base can insert a javascript: URL into the form's redirect_url. When an authenticated viewer opens the share-link and submits the form, the malicious JavaScript payload executes within the NocoDB origin.

This execution allows the attacker to read the session token stored in localStorage under the key "nocodb-gui-v2", potentially compromising the user's session.

The vulnerability was fixed in version 2026.05.1.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker with editor role or above to execute arbitrary JavaScript in the context of the NocoDB origin, potentially accessing session tokens stored in localStorage. Such unauthorized access to session tokens can lead to unauthorized data access or data breaches.

Unauthorized access to sensitive data or session tokens can impact compliance with data protection regulations such as GDPR and HIPAA, which require protection of personal and sensitive information against unauthorized access and breaches.

Therefore, this vulnerability could lead to non-compliance with these standards if exploited, due to the risk of unauthorized data exposure or compromise of user sessions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to session token theft by executing malicious JavaScript in the context of the NocoDB origin.

An attacker with editor or higher privileges can craft a malicious redirect URL that, when triggered by an authenticated viewer, steals their session token.

With the stolen session token, the attacker could impersonate the victim, gaining unauthorized access to their NocoDB session and potentially sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade NocoDB to version 2026.05.1 or later, where the issue has been fixed.

This vulnerability allows an editor or higher role user to inject a malicious javascript: URL in the form's redirect_url, which can execute code and steal session tokens when a viewer submits the form. Upgrading ensures the redirect_url is properly validated.

Useful 0 Not Useful 0