NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoint
概要
NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| nocodbnocodb |
2026.09.1 未満→ 2026.09.1 |
2026.09.1 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load.
出典: CVE.org (CVE Program・cvelistV5) NVD