https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T14:44:49.380972+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-329857 EUVD-2026-329857 2026-10-06T14:44:49.437926+00:00 EUVD-2026-329857 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47381 fkie_cve-2026-47381 2026-10-06T14:44:49.437970+00:00

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise another workspace's integration through the testConnection endpoint by supplying its ID, because the integration was fetched in a bypass scope and the caller's permission check matched any base in any workspace. This vulnerability is fixed in 2026.05.1.

 https://cve.radiocsirt.org/vuln/ghsa-96fh-m4r8-6v9v GHSA-96fh-m4r8-6v9v — NocoDB: Cross-Workspace Integration Use in Connection Test 2026-10-06T14:44:49.438009+00:00

Affected: npm: nocodb

### Summary A user in one workspace could exercise another workspace's integration through the `testConnection` endpoint by supplying its ID, because the integration was fetched in a bypass scope and the caller's permission check matched any base in any workspace.

### Details The connection-test endpoint fetched the integration in `RootScopes.BYPASS` scope and checked only that the integration was non-private and that the caller held an owner/creator role on any base in any workspace. The permission lookup is now scoped to the integration's workspace by joining on `fk_workspace_id`, and the controller rejects requests where the integration's workspace differs from the request's workspace.

### Impact Cross-tenant access to integration configuration through the connection-test endpoint, including the ability to drive the resolved database with the other workspace's credentials. Authentication with creator-or-owner role on any base in any workspace was sufficient.

### Credit This issue was reported by [@DongyangLyu](https://github.com/DongyangLyu).