NocoDB is software for creating databases with spreadsheet‑style interfaces. Prior to version 2026.05.1, the public shared‑view relation endpoints accepted a caller‑supplied column ID without checking that the column was visible in the shared view. As a result, anyone holding a shared‑view UUID could request any column ID and receive data from any LTAR column in the underlying table, even if the view owner had hidden those columns. This flaw is an authorization bypass, identified as CWE‑284, and allows unauthorized reading of protected table columns, compromising data confidentiality.

The affected product is NocoDB (nocodb:nocodb). Any installation using a version prior to 2026.05.1 is vulnerable. The problem exists in all public shared‑view relation endpoints that accept external column IDs.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting it is not known to be actively exploited. The threat is realistic because the shared view UUID is typically freely shared, and no authentication is required; an attacker merely needs the UUID and a valid column ID. With standard HTTP requests, the attacker can read the hidden column data and potentially correlate it with other information.