0xmrma/CVE-2026-46552

GitHubRepository PoCWriteup

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical writeup describing an authorization vulnerability (CVE-2026-46552) in NocoDB where a shared-base link session could be used to invite real members and gain persistent access. The artifact contains HTTP request examples and observed results but no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single README.md file that documents a security vulnerability (CVE-2026-46552) in NocoDB. It describes an authorization flaw, the attack chain, a proof-of-concept reproduction, and mitigation suggestions. The text contains no executable code, no instructions for the reader to run anything, and no concealed or deceptive payloads. It is a standard vulnerability disclosure write-up.

ClassificationWriteup
Model confidence100%
AuthenticationNot required
LanguagesMarkdown
Target softwareNocoDB
Attack typesImproper Authorization
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a detailed technical analysis of a vulnerability, including root cause, attack chain, and reproduction steps with HTTP request examples. It does not contain any executable code, script, or tool that could be used to exploit or scan for the vulnerability. The content is purely descriptive and analytical, fitting the definition of a writeup.

README.md:1-439

Requirements

  • Attacker must obtain a valid shared-base UUID (xc-shared-base-id).README.md:11

Observed behavior

  • Using only the xc-shared-base-id header, the attacker can enumerate base members via GET /api/v2/meta/bases/:baseId/users.README.md:223-227
  • Using only the xc-shared-base-id header, the attacker can invite an arbitrary email as a real base member via POST /api/v2/meta/bases/:baseId/users.README.md:231-241
  • The invited user can redeem the invite token through the normal signup flow (POST /api/v2/auth/user/signup) to obtain an authenticated account.README.md:251-260
  • The authenticated access persists even after the owner revokes the shared-base link.README.md:276-279
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Cve Reference
CVE-2026-46552The document describes a known vulnerability in NocoDB and references its assigned CVE ID.README.md:15
Http Request Example
PATCH /api/v2/meta/bases/<baseId>/sharedThe document includes example HTTP requests used in a proof-of-concept to demonstrate the vulnerability. These are descriptive, not instructions for the reader to execute.README.md:204-211
Review boundaries

What the analysis did not establish

  • The evidence consists of a single README.md file containing a vulnerability writeup. No executable source code, scripts, or scanner tools are present. The analysis is based solely on the textual description and HTTP request examples provided in the writeup.
  • Only the README.md file was provided; no other repository files were inspected.
  • Binary files were flagged as metadata-only and not analyzed, but none were identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1