CVE-2026-47381
Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise another workspace's integration through the testConnection endpoint by supplying its ID, because the integration was fetched in a bypass scope and the caller's permission check matched any base in any workspace. This vulnerability is fixed in 2026.05.1.
Summary dbcve.org
This is an authorization bypass vulnerability in NocoDB where the testConnection endpoint fetches integrations using a bypass scope, allowing users in one workspace to access another workspace's integration by supplying its ID. The permission check incorrectly matches any base in any workspace instead of restricting access to the caller's workspace.
Mitigation
Upgrade to NocoDB version 2026.05.1 or later. Until then, restrict access to the testConnection endpoint to trusted users and monitor for unauthorized cross-workspace access attempts.