This flaw allows an attacker who holds collection‑management privileges to create a benign SQL collection and then modify it with arbitrary SQL that bypasses the platform’s validation routine. Because the checkSQL() verification is omitted on the sqlCollection:update endpoint, the injected SQL can be executed when the collection is queried, giving the attacker direct access to sensitive data. The consequence is a full data breach with potential compromise of confidentiality, integrity, and availability of the underlying database.

The vulnerability affects the NocoBase platform, as distributed under the vendor nodename nocobase. Any installation running a version prior to 2.0.39 is susceptible; the fix is available in release 2.0.39. Users of earlier versions should identify whether the platform is deployed and whether their administrators have the ability to create or update SQL collections.

The CVSS score of 7.2 classifies this issue as high severity. Exploitability depends on the attacker’s possession of collection‑management rights, which typically require authentication and administrative trust. While EPSS data is unavailable, there is no evidence of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the absence of input validation on the update endpoint removes a critical security boundary, making the attack path straightforward for authorized users with malicious intent.