CVE-2026-46552

MEDIUM

NocoDB: Shared-base link access can invite arbitrary users as persistent base members

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-46552 has a selected CVSS score of 5.8 (medium); EIP currently links 1 repository PoC.

Description

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, shared-base sessions were granted the same base-member capabilities as authenticated viewers. Using only the shared-base UUID (xc-shared-base-id), an attacker could enumerate base members and invite an arbitrary email into the base as a real member. The invited user could then redeem the invite via the normal signup flow and retain authenticated access even after the owner revoked the shared link. Shared-base sessions were mapped to ProjectRoles.VIEWER in packages/nocodb/src/strategies/base-view.strategy/base-view.strategy.ts, and packages/nocodb/src/utils/acl.ts granted baseUserList and userInvite to that role. The shared frontend (packages/nc-gui/composables/useApi/interceptors.ts) deliberately removed auth headers in favour of the shared-base header, but the ACL middleware did not distinguish shared sessions from genuine viewers. This vulnerability is fixed in 2026.04.1.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 24, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

nocodb

Browse nocodb / nocodb
CVE List< 2026.04.1affected

nocodb

Browse npm / nocodb
GitHub AdvisoryThrough 0.301.3affected

Proofs of concept

1

Repository PoCs

GitHub0xmrma/CVE-2026-46552Repository PoCby 0xmrma0Writeup1 file

13.6 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical writeup describing an authorization vulnerability (CVE-2026-46552) in NocoDB where a shared-base link session could be used to invite real members and gain persistent access. The artifact contains HTTP request examples and observed results but no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single README.md file that documents a security vulnerability (CVE-2026-46552) in NocoDB. It describes an authorization flaw, the attack chain, a proof-of-concept reproduction, and mitigation suggestions. The text contains no executable code, no instructions for the reader to run anything, and no concealed or deceptive payloads. It is a standard vulnerability disclosure write-up.

ClassificationWriteup
Model confidence100%
AuthenticationNot required
LanguagesMarkdown
Target softwareNocoDB
Attack typesImproper Authorization
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a detailed technical analysis of a vulnerability, including root cause, attack chain, and reproduction steps with HTTP request examples. It does not contain any executable code, script, or tool that could be used to exploit or scan for the vulnerability. The content is purely descriptive and analytical, fitting the definition of a writeup.

README.md:1-439

Requirements

  • Attacker must obtain a valid shared-base UUID (xc-shared-base-id).README.md:11

Observed behavior

  • Using only the xc-shared-base-id header, the attacker can enumerate base members via GET /api/v2/meta/bases/:baseId/users.README.md:223-227
  • Using only the xc-shared-base-id header, the attacker can invite an arbitrary email as a real base member via POST /api/v2/meta/bases/:baseId/users.README.md:231-241
  • The invited user can redeem the invite token through the normal signup flow (POST /api/v2/auth/user/signup) to obtain an authenticated account.README.md:251-260
  • The authenticated access persists even after the owner revokes the shared-base link.README.md:276-279
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Cve Reference
CVE-2026-46552The document describes a known vulnerability in NocoDB and references its assigned CVE ID.README.md:15
Http Request Example
PATCH /api/v2/meta/bases/<baseId>/sharedThe document includes example HTTP requests used in a proof-of-concept to demonstrate the vulnerability. These are descriptive, not instructions for the reader to execute.README.md:204-211
Review boundaries

What the analysis did not establish

  • The evidence consists of a single README.md file containing a vulnerability writeup. No executable source code, scripts, or scanner tools are present. The analysis is based solely on the textual description and HTTP request examples provided in the writeup.
  • Only the README.md file was provided; no other repository files were inspected.
  • Binary files were flagged as metadata-only and not analyzed, but none were identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3