NocoBase is an AI‑powered no‑code/low‑code platform for building business applications. In versions 2.0.59 and earlier, the plugin‑collection‑sql module used a checkSQL() function with an incomplete keyword blacklist that failed to restrict PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity. This omission allowed administrators using the SQL Collection feature to read password hashes and database metadata, thereby exposing sensitive data. The flaw involves a keyword blacklist bypass (CWE‑184) and a failure to protect sensitive information (CWE‑200), and it was fixed in release 2.1.0‑alpha.46.

The vulnerability affects NocoBase version 2.0.59 and all earlier releases. The affected component is the plugin-collection-sql module, which is used by administrators to execute arbitrary SQL queries through the platform’s UI. The issue is resolved starting with version 2.1.0‑alpha.46, which patches the blacklist to exclude sensitive system tables.

The CVSS score of 6.8 indicates a moderate impact, while the EPSS score of less than 1% suggests that exploitation opportunities are currently limited. Because the flaw requires an administrative role and specific plugin usage, the attack surface is constrained, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, any administrator who can access the SQL Collection feature could extract sensitive database information, making this a significant confidentiality risk in production environments.