The vulnerability is a SQL injection flaw in NocoDB’s formula engine. An authenticated user with columnAdd permission on a Postgres‑backed base can inject arbitrary SQL into the formula engine via the optional direction argument of ARRAYSORT(...). Because the value is not validated and is directly embedded into a knex.raw ORDER BY clause, the injected SQL runs during column creation and subsequent reads of the formula column, allowing the attacker to execute arbitrary queries and potentially expose or modify sensitive data. The flaw is fixed in NocoDB 2026.04.1.

NocoDB applications running a version earlier than 2026.04.1 on a Postgres data store are affected. The flaw is linked to the Postgres mapping for ARRAYSORT in the functionMappings/pg.ts file. Users of the 2026.04.1 release or later are not vulnerable.

The flaw has a CVSS score of 6, indicating a moderate severity. The EPSS score is not available, so the current exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attacker must be authenticated with columnAdd permissions and have a Postgres‑backed database; the attack can be carried out during column definition or by inducing reads of the formula column, making exploitation practical in environments where users are granted this permission.