CVE-2026-46549: NocoDB OAuth Scope Enforcement Bypass

Technical summary

The vulnerability stems from NocoDB's OAuth token handling logic, which attached oauth_scope and oauth_granted_resources metadata to the authenticated request user object, but the downstream ACL (Access Control List) middleware never actually consulted these attributes. This meant scope-restricted tokens (e.g., those limited to specific functions or databases) were treated identically to unrestricted tokens in terms of permission evaluation. The problem was particularly acute on organization-level endpoints that do not populate req.context.base_id, allowing attackers to bypass the granted_resources.base_id restriction entirely. The fix in 2026.04.1 corrects the ACL middleware to properly validate token-level scope and resource restrictions.

Business impact

Organizations using NocoDB for multi-tenant or role-segregated access scenarios face a privilege escalation risk. Administrative staff or external collaborators granted limited-scope OAuth tokens could escalate their access to databases, features, or organization-level resources they should not reach. This undermines access control strategy and increases the blast radius of compromised credentials or insider threats. The impact is reduced by the prerequisite that an attacker must have legitimate OAuth credentials (not unauthenticated), and the UI requirement, but organizations relying on NocoDB for data segregation should treat this as a priority remediation.

Affected systems

All NocoDB deployments prior to version 2026.04.1 are affected. No vendor products are listed in the CVE record; this applies to the open-source and commercially distributed NocoDB software itself. Any instance where OAuth token-based access with restricted scopes is in use carries heightened risk.

Exploitability

Exploitation requires an attacker to possess a valid OAuth token (obtained through legitimate means, such as a compromised low-privilege account or a developer credential). The attacker must then interact with organization-level endpoints or other routes that bypass base_id validation. The CVSS score of 2.0 (LOW) reflects the requirement for high-privilege origination (PR:H), user interaction (UI:R), and the narrow scope of impact (low confidentiality, no integrity or availability impact). This is not a remotely exploitable vulnerability in the traditional sense; it is a logic flaw exploitable only by authenticated users with existing token credentials.

Remediation

Upgrade NocoDB to version 2026.04.1 or later. Organizations unable to upgrade immediately should review who has been issued OAuth tokens with restricted scopes and audit their actual access patterns in logs to identify potential misuse. Consider temporarily restricting OAuth token issuance until patched. For multi-tenant environments, verify that scope restrictions are documented and communicated to users so that any observed over-privilege can be reported.

Patch guidance

Apply version 2026.04.1 immediately if you rely on OAuth token scope restrictions for access control. The patch corrects the ACL middleware to enforce oauth_scope and oauth_granted_resources checks before granting access. Verify the patch application by issuing a test OAuth token with a restricted scope and confirming that it no longer grants access to out-of-scope resources. If running a containerized or cloud-hosted instance, check with your provider for patch availability timing.

Detection guidance

Monitor audit logs for OAuth tokens making requests to organization-level endpoints or resource types not aligned with the issued scope. Look for authentication records from service accounts or delegated users accessing databases or features outside their assigned scope. NocoDB audit logs (if enabled) should show token_id and scope metadata; correlate unexpected access patterns against issued token policies. Network-level detection is difficult since this is authenticated API misuse; focus on log analysis and periodic reviews of token usage against policy.

Why prioritize this

Although the CVSS score is low, the vulnerability directly violates a core security control—OAuth scope enforcement. Any organization using role-based access delegation via OAuth tokens should prioritize patching to restore the intended security model. The prerequisite for authentication limits mass-exploitation risk, making this a medium-priority patch for most environments, but high-priority for those where NocoDB enforces multi-user or tenant separation.

Risk score, explained

The CVSS 3.1 score of 2.0 reflects low overall severity: high privilege requirement (only valid token holders), required user interaction, and confidentiality impact only (no system availability or integrity violation). However, CVSS does not fully capture the strategic importance of OAuth token scope enforcement. Organizations relying on NocoDB for access segregation should rate this higher in their own risk model despite the low numeric score.

Frequently asked questions