Before version 2026.05.1, NocoDB’s MCP readAttachment tool did not enforce ownership checks, allowing a low‑privilege MCP token holder who knows the storage path of an attachment to read any file in shared storage, including attachments belonging to other bases and workspaces. This authorization flaw (CWE‑639) permits disclosure of files from other bases and workspaces, potentially exposing sensitive documents and configuration information. The vulnerability is fixed in 2026.05.1.

The issue affects all NocoDB installations running any version before 2026.05.1.

The CVSS score of 2.3 indicates low severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires possession of a low‑privilege MCP token and prior knowledge of the attachment path, so the attack vector is likely internal or compromised token usage. Given the low score, the risk is comparatively modest but still warrants patching because data disclosure is possible.