NocoBase CVE-2026-88402

Exploitation requires reaching NocoBase's SQL handling path - specifically the checkSQL function used by its SQL data-source / SQL-collection feature - and submitting attacker-crafted SQL, in NocoBase v2.1.21. The CVSS vector asserts no privileges or user interaction (PR:N/UI:N, remote), but this feature is normally an authenticated administrative capability, so realistic exploitation likely requires a valid account with access to define or run SQL sources; this authentication gate is the primary limiting factor and should be confirmed with the vendor. No unusual client-side interaction is needed once the endpoint is reached. Impact per the description is limited to reading sensitive database contents.

Signals conflict sharply. The vendor/NVD CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) frames this as a maximally severe unauthenticated network RCE-equivalent, and SSVC rates Technical Impact 'total' with Automatable 'yes'. However, the description scopes the impact narrowly to reading data ('access sensitive database information') via SQL injection in the checkSQL function - with no mention of write, modification, or availability loss, so the I:H/A:H components appear overstated for a read-oriented SQLi. Exploitation status is publicly available exploit code exists (POC referenced in a GitHub issue, SSVC Exploitation='poc') but this is NOT confirmed active exploitation - it is absent from CISA KEV. EPSS is very low at 0.15% (5th percentile), which is consistent with a fresh, niche-product POC that is not yet part of mass scanning. The checkSQL function is NocoBase's SQL-datasource/SQL-collection validation path, which is normally an authenticated administrative feature - this contradicts the PR:N (unauthenticated) claim in the CVSS vector and should be verified with the vendor. Net: technically real and easily weaponized once the endpoint is reachable, but the low deployment footprint, low EPSS, no KEV, and likely authentication requirement make this a medium priority rather than an emergency for most environments.

An attacker with access to NocoBase's SQL data-source / collection feature submits a crafted SQL statement that flows unsanitized through the checkSQL function, causing the injected clause to execute against the backend database. Because the injection reaches the query directly, the attacker exfiltrates sensitive rows (credentials, tokens, business data) from the connected database. A public POC exists (GitHub czx1111/cve issue #6), lowering the skill barrier, though realistic use depends on reaching the SQL feature.