CVE-2026-126285

NocoDB versions before 2026.08.0 are vulnerable to an SQL injection flaw within the legacy where parameter on PostgreSQL . The root cause is the improper concatenation of filter values in CustomKnex.ts , allowing authenticated users with read access—including those with Viewer-role —to inject sin...