Prior to 2026.05.1, an authenticated user possessing column‑create rights in NocoDB can set a column title to a SQL fragment and target the bulk groupBy endpoint. The endpoint builds three database‑specific knex.raw() aggregations that interpolate the requested column_name directly into the SQL string. Because the data‑table lookup matches both the sanitized column_name and the free‑text title, a title containing a SQL fragment bypasses the public endpoint's allowlist and reaches the query builder unescaped. This allows arbitrary SQL injection that can read, modify, or delete data in the underlying database.

The vulnerability affects NocoDB versions released prior to 2026.05.1, which includes all older 2026.04 releases and earlier. Any deployment of these versions is vulnerable if users are granted column‑create rights.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, implying limited public exploitation evidence. The vulnerability is not listed in CISA KEV. Exploitation requires authenticated access to the bulk groupBy API, which is available to users with column‑create permission, meaning the risk depends on the presence of such privileged users and the exposure of the API endpoint.