A flaw in the DATEADD formula’s unit parameter allows an authenticated user with the Creator role to inject arbitrary SQL. The injection can be used to read, alter, or delete data stored in the NocoDB database, potentially exposing confidential information or corrupting records. The vulnerability is a classic SQL injection (CWE‑89) that does not directly cause system compromise but enables a user with sufficient privileges to tamper with data integrity. Affected systems include the NocoDB application from the nocodb vendor. Versions prior to 0.301.3 are vulnerable; version 0.301.3 and newer contain the fix.

NocoDB application by nocodb; all releases before version 0.301.3 are vulnerable, while version 0.301.3 and later contain the fix.

The flaw carries a medium CVSS score of 6.2 and an EPSS score below 1%, indicating a low probability of exploitation. It is not listed in the KEV catalog. Attackers must authenticate and possess the Creator role to leverage the vulnerability. With compromised credentials, the attacker can execute arbitrary SQL through the DATEADD formula, enabling reading, modifying, or deleting data, thereby breaching confidentiality and integrity of the database. Because the attack surface is limited to legitimate accounts, the overall threat remains moderate but warrants timely patching to prevent data compromise.