{"id":"CVE-2026-47378","aliases":["GHSA-4w6r-5c2j-qf5f"],"url":"https://o3.security/vulnerability/CVE-2026-47378","summary":"NocoDB: Hidden Column Exposure in Public Shared View Endpoints","details":"### Summary\nPublic shared-view endpoints exposed values from columns that the view owner had\nhidden, via three independent paths: groupBy returned raw values for any column\nnamed in the request, filter and sort arrays operated on hidden columns enabling\nboolean-blind extraction, and the related-data list accepted arbitrary link-column\nIDs from other tables in the same base.\n\n### Details\nA new `sanitizeListArgsForPublicView` helper now strips request keys that should\nnever be caller-controlled (e.g. `getHiddenColumn`, `nested`), parses `where`\nclauses against a restricted alias map that only contains visible columns, and\nrecursively removes filter/sort entries whose `fk_column_id` is not in the visible\nset. `validateGroupByColumnNames` and `validateGroupColumnId` reject groupBy\nrequests whose `column_name` (CSV-style) or `groupColumnId` is not in the visible\nor group-by column set. `relDataList` now checks `column.fk_model_id ===\ncurrentModel.id` before resolving the linked table, matching the pre-existing\ncheck on `publicMmList` and `publicHmList`.\n\n### Impact\nAnyone with a shared-view UUID could enumerate hidden-column values directly (via\ngroupBy), confirm hidden-column values by observing row counts (via filter), or\nread records from unrelated tables in the same base (via the related-data list).\nNo authentication was required.\n\n### Credit\nThis issue was reported by [@0xBassia](https://github.com/0xBassia).\nIt was independently reported by [@b-hermes](https://github.com/b-hermes).","published":"2026-06-23T20:34:10.037Z","modified":"2026-08-12T03:51:35.407812349Z","cvss":null,"epss":{"score":0.00406,"percentile":0.34429,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"nocodb","fixedVersion":"2026.04.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47378.json"},{"type":"ADVISORY","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-4w6r-5c2j-qf5f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47378"},{"type":"PACKAGE","url":"https://github.com/nocodb/nocodb"},{"type":"WEB","url":"https://github.com/nocodb/nocodb/releases/tag/2026.04.1"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:35.407812349Z"}}