CVE-2026-47279

MediumCVSS 6.9/10Last modified Jun 25, 2026

Description

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints accepted a caller-supplied column ID without verifying that the column was visible in the shared view, so anyone holding a share UUID could read links from any LTAR column on the view's table — including columns the view owner had hidden. publicMmList, publicHmList, and relDataList already ensured that the requested column belonged to the view's model, but did not check the view-column entry's show flag. This vulnerability is fixed in 2026.05.1.

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Jun 23, 2026
Last modified
Jun 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-47286.5Spoofing issue in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.CVE-2026-472809.8Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network.CVE-2026-472819.6Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.CVE-2026-472826.5Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over aCVE-2026-472846.5Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information oveCVE-2026-472856.5Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker toCVE-2026-472876.5Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.CVE-2026-472887.1Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent network.CVE-2026-472898.8Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-47299.8Memory safety bugs present in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that wCVE-2026-472907.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-472919.8Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.
CVE-2026-47279: Medium severity, CVSS 6.9 | Vulnix