https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 13:33:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329810 EUVD-2026-329810 https://cve.radiocsirt.org/vuln/euvd-2026-329810 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46549 <p>NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the OAuth token strategy attached oauth_scope and oauth_granted_resources to the request user, but the ACL middleware never consulted either. An OAuth token issued with a restricted scope (e.g. MCP-only) therefore inherited the full permissions of the underlying user across all routes; the granted_resources.base_id restriction was bypassed on org-level endpoints that don&#39;t populate req.context.base_id. This vulnerability is fixed in 2026.04.1.</p> <p>NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the OAuth token strategy attached oauth_scope and oauth_granted_resources to the request user, but the ACL middleware never consulted either. An OAuth token issued with a restricted scope (e.g. MCP-only) therefore inherited the full permissions of the underlying user across all routes; the granted_resources.base_id restriction was bypassed on org-level endpoints that don&#39;t populate req.context.base_id. This vulnerability is fixed in 2026.04.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46549 https://cve.radiocsirt.org/vuln/ghsa-m5qg-rvjq-727p <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary</p> <p>The OAuth token strategy attached `oauth_scope` and `oauth_granted_resources` to the request user, but the ACL middleware never consulted either. An OAuth token issued with a restricted scope (e.g. MCP-only) therefore inherited the full permissions of the underlying user across all routes; the `granted_resources.base_id` restriction was bypassed on org-level endpoints that don&#39;t populate `req.context.base_id`.</p> <p>### Details</p> <p>In `packages/nocodb/src/strategies/oauth-token.strategy.ts`, the strategy set `is_oauth_token`, `oauth_client_id`, `oauth_granted_resources`, and `oauth_scope` on the user object, then mapped through to the user&#39;s existing `roles` / `base_roles`. The ACL middleware in `extract-ids.middleware.ts` honoured `is_api_token` via `blockApiTokenAccess` but had no equivalent gate for `is_oauth_token` or scope-string enforcement.</p> <p>The base/workspace restriction logic short-circuited when `req.context.base_id` was unset (org-level routes), so an OAuth token scoped to one base could still call org-level endpoints as the underlying user.</p> <p>The fix adds a path-prefix allowlist (`[&#39;/mcp&#39;, &#39;/api/v3/&#39;, &#39;/auth/user/me&#39;]`) enforced inside the strategy and a `blockOAuthTokenAccess` ACL flag for endpoints that should never accept OAuth tokens.</p> <p>### Impact</p> <p>- Scope escalation: tokens issued with a narrow scope received the underlying user&#39;s full role. - Resource boundary bypass: per-base restrictions did not apply to org-level routes. - Violates least-privilege exp…</p> <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary</p> <p>The OAuth token strategy attached `oauth_scope` and `oauth_granted_resources` to the request user, but the ACL middleware never consulted either. An OAuth token issued with a restricted scope (e.g. MCP-only) therefore inherited the full permissions of the underlying user across all routes; the `granted_resources.base_id` restriction was bypassed on org-level endpoints that don&#39;t populate `req.context.base_id`.</p> <p>### Details</p> <p>In `packages/nocodb/src/strategies/oauth-token.strategy.ts`, the strategy set `is_oauth_token`, `oauth_client_id`, `oauth_granted_resources`, and `oauth_scope` on the user object, then mapped through to the user&#39;s existing `roles` / `base_roles`. The ACL middleware in `extract-ids.middleware.ts` honoured `is_api_token` via `blockApiTokenAccess` but had no equivalent gate for `is_oauth_token` or scope-string enforcement.</p> <p>The base/workspace restriction logic short-circuited when `req.context.base_id` was unset (org-level routes), so an OAuth token scoped to one base could still call org-level endpoints as the underlying user.</p> <p>The fix adds a path-prefix allowlist (`[&#39;/mcp&#39;, &#39;/api/v3/&#39;, &#39;/auth/user/me&#39;]`) enforced inside the strategy and a `blockOAuthTokenAccess` ACL flag for endpoints that should never accept OAuth tokens.</p> <p>### Impact</p> <p>- Scope escalation: tokens issued with a narrow scope received the underlying user&#39;s full role. - Resource boundary bypass: per-base restrictions did not apply to org-level routes. - Violates least-privilege exp…</p> https://cve.radiocsirt.org/vuln/ghsa-m5qg-rvjq-727p