VulnSocial

CVE-2026-47384Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column's title to a SQL fragment. The bulk groupBy path in group-by.ts builds three database-specific knex.raw() aggregations that interpolate the request's column_name directly into the SQL string. Column lookup in data-table.service.ts matches on both the sanitized column_name field and the free-text title, so a title containing a SQL fragment bypasses the public endpoint's existing column allowlist and reaches the query builder unescaped. This vulnerability is fixed in 2026.05.1.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-06-23: 2Technical Details · 2026-06-23: 206-23
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-47384 NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupB… https://www.cve.org/CVERecord?id=CVE-2026-47384 ----- Traducción: CVE-2026-47384 Noc… http://infoflow.cloud`

    Post summary

    CVE-2026‑47384 reports a SQL injection vulnerability in NocoDB accessible to authenticated users with column‑create rights during bulk operations.

    0000028
    88 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-47384 NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupB… https://www.cve.org/CVERecord?id=CVE-2026-47384

    Post summary

    The text announces CVE‑2026‑47384, detailing an SQL injection vulnerability in NocoDB before version 2026.05.1, without providing PoC, exploit, or patch information.

    00000613
    57.7K followersView on X

Explore more

Back to dashboard