{"items":[{"id":"NVI-00016130","kind":"vulnerability","title":"NocoDB: Hidden Column Exposure in Public Shared View Endpoints","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-4w6r-5c2j-qf5f","CVE-2026-47378"],"plain_summary":"GitHub lists this reviewed advisory for nocodb. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2ba2c5cfa46252dc9a02fadb655840b8"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2ba2c5cfa46252dc9a02fadb655840b8","url":"https://github.com/advisories/GHSA-4w6r-5c2j-qf5f","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-4w6r-5c2j-qf5f","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T02:47:44.783Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2ba2c5cfa46252dc9a02fadb655840b8"],"technology":"nocodb","known_exclusions":[],"conditions_summary":"### Summary\nPublic shared-view endpoints exposed values from columns that the view owner had\nhidden, via three independent paths: groupBy returned raw values for any column\nnamed in the request, filter and sort arrays operated on hidden columns enabling\nboolean-blind extraction, and the related-data list accepted arbitrary link-column\nIDs from other tables in the same base.\n\n### Details\nA new `sanitizeListArgsForPublicView` helper now strips request keys that should\nnever be caller-controlled (e.g. `getHiddenColumn`, `nested`), parses `where`\nclauses against a restricted alias map that only contains visible columns, and\nrecursively removes filter/sort entries whose `fk_column_id` is not in the visible\nset. `validateGroupByColumnNames` and `validateGroupColumnId` reject groupBy\nrequests whose `column_name` (CSV-style) or `groupColumnId` is not in the visible\nor group-by column set. `relDataList` now checks `column.fk_model_id ===\ncurrentModel.id` before resolving the linked table, matching the pre-existing\ncheck on `publicMmList` and `publicHmList`.\n\n### Impact\nAnyone with a shared-view UUID could enumerate hidden-column values directly (via\ngroupBy), confirm hidden-column values by","public_affected_ranges":["< 2026.04.1"]}],"null_published_at":"2026-11-04T10:04:27.896Z","source_updated_at":"2026-07-20T21:19:44.000Z","source_disclosed_at":"2026-06-05T16:03:11.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T02:47:44.783Z"}],"next_cursor":null,"snapshot_revision":"42594"}