NocoDB is software for building databases as spreadsheets. Prior to version 2026.04.1, public shared‑view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean‑blind extraction, and the related‑data list accepted arbitrary link‑column IDs from other tables in the same base. Consequently, any user with a public shared‑view URL can read sensitive data that was intended to remain concealed. The weakness is classified as CWE‑639.

The affected product is NocoDB. All versions released before 2026.04.1 are vulnerable. The vulnerability was fixed in the 2026.04.1 release. No other vendors are implicated.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS value is not published. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker who can access a publicly shared view endpoint; no additional credentials or privileged access are needed. An attacker could craft requests that exploit groupBy, filter/sort, or related‑data paths to extract hidden column values. The ease of exploitation is high because the endpoints are exposed to anyone with the shared URL.