NocoBase CVE-2026-52887

Requires a valid authenticated NocoBase account (any self-signed-up user; the description says 'signed-up authenticated user'), network reachability to the application, and a PostgreSQL backend that permits stacked statements. Full escalation to command execution additionally requires the PostgreSQL role NocoBase connects as to have superuser or pg_execute_server_program privileges, as COPY ... TO PROGRAM is gated on that; without it, the attacker is limited to arbitrary SQL read/write rather than OS commands. Limiting factors: authentication is mandatory (contradicting the vendor's PR:N rating), so instances that disable public registration are not exploitable by anonymous outsiders; the vulnerable path lives in the optional in-app-message notification plugin, so deployments that do not run that plugin are unaffected; and RCE severity depends on the database privilege level described above.

The signals are mostly aligned toward high priority but contain one material conflict. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) claims no privileges required (PR:N), yet the description explicitly states exploitation requires a 'signed-up authenticated user' - these contradict each other; PR:L is more defensible and would lower the base score slightly. That caveat aside, real-world risk is high: the attack is network-reachable, low-complexity, requires no user interaction, and yields command execution (scope-changed, full C/I/A loss) on the DB host. EPSS was not provided, so exploitation-probability cannot be quantified. There is no CISA KEV listing and no publicly identified exploit, so this is not confirmed active exploitation; however, the fix commit ships an injection regression test ('0) OR 1=1 --'), which effectively discloses the injection point and lowers the bar for exploit development. SSVC data was not supplied, but by inspection the technical impact is total and the attack is likely automatable once authenticated. Bottom line: treat as a genuine high/critical priority for any internet-exposed NocoBase instance that allows user self-signup, while noting the authentication prerequisite meaningfully limits fully anonymous mass exploitation.

An attacker registers an ordinary account on an internet-facing NocoBase instance, authenticates, and sends GET /api/myInAppChannels:list with a crafted filter[latestMsgReceiveTimestamp][$lt] payload that closes the intended clause and appends stacked SQL. They then issue COPY (SELECT '') TO PROGRAM '<shell command>' to run OS commands on the database host. Given AV:N/AC:L and no user interaction, this is straightforward to automate once an account exists; no public exploit is currently published but the patched code discloses the exact injection point.