NocoBase CVE-2026-52888

Exploitation requires an authenticated NocoBase admin-role account (confirmed by PR:H in the CVSS vector). The @nocobase/plugin-collection-sql plugin must be installed and active - it is a separately enabled plugin, not a core NocoBase component. The backend database must be PostgreSQL; pg_shadow, pg_roles, and pg_stat_activity are PostgreSQL-specific system catalog tables unavailable in MySQL or SQLite deployments. The PostgreSQL role used by NocoBase must have sufficient privileges to query pg_shadow - typically true when NocoBase connects as a superuser or pg_shadow-read-capable role, which is common in default deployments. Non-admin NocoBase users cannot define SQL Collections and are not affected. No network-level special conditions are required beyond admin access to the NocoBase web interface.

The CVSS 3.1 score of 6.8 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N captures the tension between high confidentiality impact and a high-privilege prerequisite. The PR:H requirement substantially constrains real-world risk - exploitation is limited to actors who already hold a trusted NocoBase admin account. That said, the S:C metric is accurate: a successful exploit crosses the application boundary into PostgreSQL system catalogs, returning bcrypt password hashes that could enable offline cracking and lateral movement into the database directly. Risk escalates in shared NocoBase deployments where the admin role is distributed across multiple operators who are not fully trusted database superusers, or in scenarios where a lower-privilege account is escalated to admin through a separate vulnerability. No EPSS data was provided in the input; exploitation probability cannot be quantified. This CVE is not in CISA KEV, and no public exploit code has been identified. The commit-confirmed subquery bypass (wrapping pg_shadow in a derived table) demonstrates the original blocklist was exploitable by any admin through trivially obfuscated SQL, which increases confidence that in-the-wild exploitation was feasible for any admin with knowledge of PostgreSQL internals.

An authenticated NocoBase administrator navigates to the SQL Collection configuration interface and creates a new collection using the query SELECT usename, passwd FROM pg_shadow or its subquery variant SELECT * FROM (SELECT usename, passwd FROM pg_shadow) AS passwords. Both forms bypass the original keyword blacklist, and the application executes the query against PostgreSQL, returning bcrypt-hashed credentials for all database users. The attacker then runs offline hash-cracking against the retrieved hashes to recover plaintext passwords, enabling direct database access independent of the NocoBase application.