CVE-2026-52888 Details
Description
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts with an incomplete keyword blacklist that did not restrict PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity, allowing an admin-role user to read password hashes and database metadata through the SQL Collection feature. This vulnerability is fixed in 2.1.0-alpha.46.
A vulnerability in NocoBase versions through 2.0.59 in the SQL Collection feature of the plugin '@nocobase/plugin-collection-sql' allows admin-role users to bypass an incomplete SQL keyword blacklist. This oversight enables access to sensitive PostgreSQL system catalog tables, such as 'pg_shadow', 'pg_roles', and 'pg_stat_activity', leading to unauthorized reading of password hashes and database metadata. The vulnerability arises from the 'checkSQL()' function, which failed to adequately restrict access to these critical system tables, allowing exploitation by authenticated users with admin privileges.
Users can update to NocoBase version 2.1.0-alpha.46 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nocobase/nocobase/security/advisories/GHSA-v8vm-cqh8-q87q | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nocobase/nocobase/commit/87c548969ce9258dd7f0d9571c9453ae10bc3fc4 | [email protected] | Source CodeVendor |
| https://github.com/nocobase/nocobase/releases/tag/v2.1.0-alpha.46 | [email protected] | Release NotesVendor |
| https://github.com/nocobase/nocobase/security/advisories/GHSA-v8vm-cqh8-q87q | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NocoBase | <= 2.0.59 (semver) |
CPE
Remediation
| |
| NocoBase plugin-collection-sql | <= 2.0.59 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |