CVE-2026-47388

LOW EPSS 11.1%

Published Jun 23, 20261w ago · Modified Jun 24, 20261w ago

2.3 CVSS 4.0

Low

Published Jun 23, 2026 1w ago

Last Modified Jun 24, 2026 1w ago

Description

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with knowledge of an attachment path could read any file in shared storage, including attachments belonging to other bases and workspaces, because the MCP readAttachment tool did not verify the file's ownership. This vulnerability is fixed in 2026.05.1.

CVSS Details

Base Score

2.3

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity High

Privileges Required Low

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

11.1% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-639

References 1

github.com https://github.com/nocodb/nocodb/security/advisories/GHSA-xxpj-q764-9r6q

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.