CVE-2026-46552: NocoDB Shared-Base Access Control Bypass Allows Unauthorized Member Enrollment

Technical summary

The vulnerability exists in NocoDB's access control layer across multiple components. Shared-base sessions are incorrectly mapped to ProjectRoles.VIEWER in base-view.strategy.ts, and the ACL middleware in acl.ts inadvertently grants baseUserList and userInvite permissions to that role. The shared frontend (useApi/interceptors.ts) strips authentication headers in favor of the shared-base header, but the ACL enforcement does not differentiate between shared sessions and authenticated viewer accounts. This allows an attacker with only the shared-base UUID to invoke member enumeration and user invitation endpoints as if they were a legitimate base member. The invited user receives a valid signup invitation that, once redeemed, provides persistent authenticated session access independent of the shared link's revocation status.

Business impact

Organizations using NocoDB for sensitive data sharing risk unauthorized member enumeration, phishing attacks through fraudulent invitations sent to external addresses, and loss of access control when shared links are meant to be temporary. An attacker can permanently graft unauthorized users into a database, bypassing the owner's intention to limit exposure. This undermines the security model of temporary, revocable sharing and creates persistent unauthorized access paths that may go undetected until abuse occurs.

Affected systems

All NocoDB installations prior to version 2026.04.1 are affected. The vulnerability applies to any shared base that is accessed via the xc-shared-base-id mechanism, making any deployment sharing databases with external parties at risk.

Exploitability

Exploitation requires only network access and knowledge of a valid shared-base UUID. No authentication credentials, user interaction, or special configuration is required; an attacker can enumerate members and send invitations immediately upon obtaining the identifier. The attack is straightforward and does not depend on complex manipulation or race conditions. The CVSS score of 5.8 (Medium) reflects the network-based, low-complexity nature of the attack, constrained by the limited scope of the shared-base context and the fact that confidentiality impact (enumeration) is present but integrity and availability are not directly affected.

Remediation

Upgrade to NocoDB version 2026.04.1 or later, which corrects the ACL enforcement logic to properly distinguish shared sessions from authenticated members and restricts sensitive operations (baseUserList, userInvite) to genuinely authenticated users. After patching, audit existing base invitations and membership lists to identify and remove unauthorized or suspicious accounts introduced during the exposure window.

Patch guidance

Install NocoDB 2026.04.1 or any subsequent release. Patch immediately in shared-base deployments, as the vulnerability is easily triggered by anyone with access to a shared link identifier. Verify the patch has been applied by checking the NocoDB version in your deployment and reviewing the base-view.strategy and acl middleware implementations to confirm the ACL distinction has been restored. Plan the upgrade during a maintenance window if NocoDB is in production.

Detection guidance

Monitor audit logs for unusual member enumeration patterns or unexpected user invitations sent from shared-base sessions (identified by xc-shared-base-id header without corresponding authentication tokens). Look for invitations to external email addresses that do not correspond to known organizational users, or a spike in baseUserList API calls originating from shared-link access paths. If available, enable network telemetry to track anomalous access to shared-base endpoints that perform sensitive operations. Review base membership and compare against expected users; accounts created shortly after a shared link became active warrant investigation.

Why prioritize this

Although the CVSS score is Medium, prioritize patching because: (1) the attack requires no authentication or user interaction, (2) the vulnerability enables persistent access gain (not just temporary information disclosure), (3) shared links are often used in sensitive or confidential workflows where unauthorized membership is particularly damaging, and (4) revocation of the shared link does not remove the attacker's persistent access, making the threat window effectively unlimited until bases are audited and compromised accounts are removed.

Risk score, explained

CVSS 5.8 (Medium) reflects a network-accessible vulnerability with low complexity and no privilege requirement. Confidentiality impact is low (member enumeration and invitation history may be observed), integrity and availability are not impacted in the CVSS model, and scope is changed because the attack affects the security posture of users outside the shared-base resource itself. However, the practical risk is elevated relative to the score because the vulnerability enables account injection with persistent consequences, and shared bases are often used for sensitive external collaboration.

Frequently asked questions