NocoBase CVE-2026-112306

Exploitation requires an authenticated NocoBase user who holds the 'collection-sql' snippet permission (a specific privilege grant, not merely any logged-in account) and the ability to invoke the sqlCollection:setFields action. The backend must be PostgreSQL for the described impact, since the attack leverages PostgreSQL-specific primitives (pg_shadow table and the pg_read_file function). The flaw works against affected versions through 2.2.28 by replacing a previously-validated benign collection query with malicious SQL that bypasses checkSQL(), which executes on the next collection reload. Limiting factors: no unauthenticated access, no self-service registration path to this privilege by default, high privilege requirement (PR:H), and PostgreSQL-specific payloads for the hash-dump/file-read impact - in environments where collection-sql operators are already trusted near-admins, the marginal risk is lower.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC/VI/VA all High, score 8.6) is internally consistent with the description: network-reachable, low complexity, no user interaction, but requiring HIGH privileges - specifically a user already holding the collection-sql snippet. That PR:H is the single most important risk-limiting signal and it is corroborated by the description's phrase 'allows privileged users.' No EPSS score, KEV listing, or SSVC decision data was provided in the input. The vulnerability is sourced from a VulnCheck advisory and a public GitHub issue (#10629) with a direct link to the vulnerable source (sql.ts#L14-L104), which raises the practical likelihood that working exploit logic can be reconstructed, but no explicit public exploit code (POC) is claimed - so per precision rules this is 'no public exploit identified at time of analysis.' Signals are not conflicting: both CVSS and description agree exploitation needs privileged/authenticated access. The realistic risk is post-authentication privilege-to-database/host escalation (reading pg_shadow password hashes and pg_read_file for arbitrary file disclosure), not mass unauthenticated compromise - making this high-value in multi-tenant or least-privilege NocoBase deployments where a 'collection-sql' operator is not meant to reach the raw database or filesystem. EPSS and KEV absence means widespread automated exploitation is unproven.

An attacker who already holds the collection-sql snippet permission in NocoBase (a mid-tier privileged user, not an admin) crafts a request to the sqlCollection:setFields action to store malicious SQL that bypasses the checkSQL() validation. When the SQL collection is reloaded, the stored statement executes against the PostgreSQL backend, letting the attacker dump pg_shadow password hashes or read arbitrary files via pg_read_file. No public POC is identified, though the advisory and the linked vulnerable source code (sql.ts) substantially lower the barrier to weaponization.