NocoDB: Shared-base link access can invite arbitrary users as persistent base members

Vulnerability

Overview

CVE-2026-46552 is a privilege escalation vulnerability in NocoDB affecting shared-base sessions. The core issue is that in packages/nocodb/src/strategies/base-view.strategy/base-view.strategy.ts, shared-base sessions were assigned the ProjectRoles.VIEWER role. The ACL utility in packages/nocodb/src/utils/acl.ts then granted the permissions baseUserList and userInvite to that role, without distinguishing between authenticated viewers and anonymous shared-base sessions [1][2].

Attack

Vector

An attacker in possession of a valid shared-base UUID (xc-shared-base-id) can first call GET /api/v2/meta/bases/:baseId/users to enumerate all existing base member email addresses. Using those or any target email, they can then call POST /api/v2/meta/bases/:baseId/users to invite the address as a real base member. The back-end service inserts a new nc_users_v2 row with an invite_token and creates a corresponding nc_base_users_v2 row [1][2]. No additional authentication is required beyond the shared-link identifier.

Impact

The invited user receives an invite token that can be redeemed through the standard NocoDB signup flow, granting a persistent JWT-based authenticated session scoped to the base. Crucially, this access remains valid even after the owner revokes or deletes the original shared link. The vulnerability thus enables unauthorized disclosure of member email addresses, unauthorized addition of base members, and persistent access that bypasses link-level revocation controls [1][2].

Mitigation

According to the advisory, the fix involves properly distinguishing shared-base sessions from authenticated viewer sessions in the ACL middleware and removing the unintended permissions from the shared-base role [1][2].