CVE-2026-47387Disclosure

LOWCVSS 8.4 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore.ts) in NocoDB writes the form's redirect_url to window.location.href after a same-host check that does not validate the URL scheme. A user with editor role (or above) on any base can plant a javascript: URL in the form's redirect_url; when an authenticated viewer opens the share-link and submits the form, the payload executes in the NocoDB origin and can read the session token from localStorage["nocodb-gui-v2"]. This vulnerability is fixed in 2026.05.1.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://github.com/nocodb/nocodb/security/advisories/GHSA-hj85-ph9q-78jg

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-06-23); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-23	2	Disclosure2
2026-06-24	1	General1

Full discourse3 posts

Vulmon Vulnerability Feed@VulmonFeeds91d
General
CVE-2026-47387 Open Redirect and Session Token Theft in NocoDB Prior to ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47387 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet references CVE‑2026‑47387 with links to vulnerability details, noting an open‑redirect and session token theft issue, but provides no PoC, exploit, or remediation information.
00000103
4.1K followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-47387 NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore… https://www.cve.org/CVERecord?id=CVE-2026-47387 ----- Traducción: CVE-2026-47387 Noc… http://infoflow.cloud`
Post summary
An announcement of CVE‑2026‑47387 for NocoDB highlights the affected version and component, but no PoC, exploit, or mitigation is discussed.
0000029
88 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-47387 NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore… https://www.cve.org/CVERecord?id=CVE-2026-47387
Post summary
The post reports the CVE for NocoDB, referencing the affected component and a cve.org link, but offers no evidence of exploitation, patches, or PoC.
00000659
57.7K followersView on X

Explore more

Back to dashboard