NocoDB is a database‑as‑spreadsheet platform. Prior to version 2026.04.1, shared‑base sessions were granted the same base‑member capabilities as authenticated viewers. By supplying only the shared‑base UUID (xc‑shared‑base‑id), an attacker can enumerate current base members and issue a new invitation to any arbitrary email address. The invited user can accept the invite via the normal signup flow, thereby gaining authenticated access that persists even if the link owner revokes the shared link, effectively allowing unauthorized persistent membership and privilege escalation within the base.

The vulnerability affects all NocoDB deployments running any version prior to 2026.04.1. NocoDB is the product delivered by the vendor nocodb.

The CVSS score of 5.8 indicates a moderate severity vulnerability. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by targeting a shared‑base link presented to a user; they can use the shared‑base UUID to invite additional users as base members. The lack of distinction between shared sessions and authenticated viewers in the ACL logic is the root of the issue.