https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 00:09:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329805 EUVD-2026-329805 https://cve.radiocsirt.org/vuln/euvd-2026-329805 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47279 <p>NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints accepted a caller-supplied column ID without verifying that the column was visible in the shared view, so anyone holding a share UUID could read links from any LTAR column on the view&#39;s table — including columns the view owner had hidden. publicMmList, publicHmList, and relDataList already ensured that the requested column belonged to the view&#39;s model, but did not check the view-column entry&#39;s show flag. This vulnerability is fixed in 2026.05.1.</p> <p>NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints accepted a caller-supplied column ID without verifying that the column was visible in the shared view, so anyone holding a share UUID could read links from any LTAR column on the view&#39;s table — including columns the view owner had hidden. publicMmList, publicHmList, and relDataList already ensured that the requested column belonged to the view&#39;s model, but did not check the view-column entry&#39;s show flag. This vulnerability is fixed in 2026.05.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47279 https://cve.radiocsirt.org/vuln/ghsa-9wgh-m22w-9xj8 <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary The public shared-view relation endpoints accepted a caller-supplied column ID without verifying that the column was visible in the shared view, so anyone holding a share UUID could read links from any LTAR column on the view&#39;s table — including columns the view owner had hidden.</p> <p>### Details `publicMmList`, `publicHmList`, and `relDataList` already ensured that the requested column belonged to the view&#39;s model, but did not check the view-column entry&#39;s `show` flag. All three handlers now also fetch the shared view&#39;s column entries and reject the request unless the matching entry has `show=true`. The four public relation routes covered by the fix are:</p> <p>- `GET /api/v2/public/shared-view/:uuid/rows/:rowId/mm/:columnId` (many-to-many) - `GET /api/v2/public/shared-view/:uuid/rows/:rowId/hm/:columnId` (has-many) - `GET /api/v2/public/shared-view/:uuid/rows/:rowId/{ln,om}/:columnId` (links / one-to-many — both share the many-to-many handler) - `GET /api/v2/public/shared-view/:uuid/nested/:columnId` (form/gallery picker)</p> <p>### Impact Anyone holding a share UUID could enumerate the full set of linked records for any hidden LTAR column on the view&#39;s table by calling the relation endpoint directly, even when the same column was correctly omitted from the public `/rows` response.</p> <p>### Credit This issue was reported by [@leduckhuong](https://github.com/leduckhuong).</p> <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary The public shared-view relation endpoints accepted a caller-supplied column ID without verifying that the column was visible in the shared view, so anyone holding a share UUID could read links from any LTAR column on the view&#39;s table — including columns the view owner had hidden.</p> <p>### Details `publicMmList`, `publicHmList`, and `relDataList` already ensured that the requested column belonged to the view&#39;s model, but did not check the view-column entry&#39;s `show` flag. All three handlers now also fetch the shared view&#39;s column entries and reject the request unless the matching entry has `show=true`. The four public relation routes covered by the fix are:</p> <p>- `GET /api/v2/public/shared-view/:uuid/rows/:rowId/mm/:columnId` (many-to-many) - `GET /api/v2/public/shared-view/:uuid/rows/:rowId/hm/:columnId` (has-many) - `GET /api/v2/public/shared-view/:uuid/rows/:rowId/{ln,om}/:columnId` (links / one-to-many — both share the many-to-many handler) - `GET /api/v2/public/shared-view/:uuid/nested/:columnId` (form/gallery picker)</p> <p>### Impact Anyone holding a share UUID could enumerate the full set of linked records for any hidden LTAR column on the view&#39;s table by calling the relation endpoint directly, even when the same column was correctly omitted from the public `/rows` response.</p> <p>### Credit This issue was reported by [@leduckhuong](https://github.com/leduckhuong).</p> https://cve.radiocsirt.org/vuln/ghsa-9wgh-m22w-9xj8