Prior to version 2026.04.1, NocoDB’s public shared‑view endpoints exposed values from columns that the view owner had hidden. The vulnerability was realized through three distinct code paths: a groupBy function returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean‑blind extraction, and the related‑data list accepted arbitrary link‑column IDs from other tables in the same base. Consequently, any user with a public shared‑view URL could read sensitive data that was intended to remain concealed. The weakness is classified as CWE‑639, reflecting an information‑exposure defect arising from insufficient authorization checks.

The affected product is NocoDB. All versions released before 2026.04.1 are vulnerable. The vulnerability was fixed in the 2026.04.1 release. No other vendors are implicated.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS value is not published. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker who can access a publicly shared view endpoint; no additional credentials or privileged access are needed. An attacker could craft requests that exploit groupBy, filter/sort, or related‑data paths to extract hidden column values. The ease of exploitation is high because the endpoints are exposed to anyone with the shared URL.