CVE-2026-46549

Description

NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation

Overview

State

—

Assigner (CNA)

—

CVSS severity

low

CVSS score

1.7 / 10

CVSS vector

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Effective score

1.7 / 10 LOW source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-46549

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-38586

Assigner

GitHub_M

Published

Jun 23, 2026, 8:40:24 PM

Updated

Jun 24, 2026, 1:17:16 PM

EUVD base score (CVSS 3.1)

2.0 / 10
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

EUVD-reported EPSS

0.1500

Vendors

nocodb

Products

nocodb (< 2026.04.1)

Aliases

GHSA-m5qg-rvjq-727p

ENISA description: NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the OAuth token strategy attached oauth_scope and oauth_granted_resources to the request user, but the ACL middleware never consulted either. An OAuth token issued with a restricted scope (e.g. MCP-only) therefore inherited the full permissions of the underlying user across all routes; the granted_resources.base_id restriction was bypassed on org-level endpoints that don't populate req.context.base_id. This vulnerability is fixed in 2026.04.1.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-46549 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-46549 tenable:www.cve.org

• Microsoft Defender Zero-Day Vulnerabilities: CVE-2026-41091 and CVE ...
  web:aviatrix.ai

  Microsoft has disclosed two critical zero-day vulnerabilities in Defender, actively exploited before patches were released. Learn about CVE - 2026 -41091 and CVE - 2026 -45498 and how to protect your systems.

  2026-05-26 03:09 UTC
• Microsoft Defender CVE-2026-41091 and CVE-2026-45498 Exploited
  web:blog.gridinsoft.com

  Microsoft has confirmed exploitation of two Microsoft Defender vulnerabilities fixed in the May 2026 security update cycle. CVE - 2026 -41091 is an elevation-of-privilege flaw in the Microsoft Malware Protection Engine, while CVE - 2026 -45498 is a denial-of-service flaw in the Microsoft Defender Antimalware Platform . The first bug matters more for incident response because a local authorized ...

  2026-05-26 03:09 UTC
• Microsoft Defender CVEs: CVE-2026-41091 (local privilege escalation ...
  web:blog.toolslib.net

  Microsoft Defender CVEs : CVE - 2026 -41091 (local privilege escalation via link following) and CVE - 2026 -45498 (denial of service). What's confirmed, what's unclear, and where to find official Microsoft guidance.

  2026-05-26 03:09 UTC
• CISA Warns of Exploited Microsoft Defender 0-Day Flaws
  web:cyberpress.org

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

  2026-05-26 03:09 UTC
• CISA Warns of Microsoft Defender 0-Day Vulnerabilities Exploited in Attacks
  web:cybersecuritynews.com

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, warning organizations of active exploitation risks. The flaws, tracked as CVE - 2026 -45498 and CVE - 2026 -41091, impact Microsoft Defender and could allow attackers to disrupt systems or escalate privileges. Both ...

  2026-05-26 03:09 UTC
• Microsoft Defender CVE-2026-41091 and CVE-2026-45498 Exploited
  web:howtofix.guide

  CISA added both CVE - 2026 -41091 and CVE - 2026 -45498 to its Known Exploited Vulnerabilities catalog on May 20, with a federal remediation due date of June 3, 2026 . [4] That KEV entry does not mean every home PC is currently targeted, but it is a clear signal that defenders should not wait for the next normal maintenance window.

  2026-05-26 03:09 UTC
• Microsoft Defender CVE-2026-41091 & CVE-2026-45498
  web:thecyberexpress.com

  Microsoft confirms active exploitation of CVE - 2026 -41091 and CVE - 2026 -45498 in Defender, with CVSS-rated risks, KEV listing, and urgent patches issued.

  2026-05-26 03:09 UTC
• CVE-2026-41091 and CVE-2026-45498: Microsoft Defender Flaws Actively ...
  web:vulert.com

  Microsoft warns that two Defender vulnerabilities, CVE - 2026 -41091 and CVE - 2026 -45498, are actively exploited. Learn impact, fixed versions, update steps, and how Vulert can help.

  2026-05-26 03:09 UTC
• Microsoft warns of new Defender zero-days exploited in attacks
  web:www.bleepingcomputer.com

  On Wednesday, Microsoft started rolling out security patches for two Defender vulnerabilities that have been exploited in zero-day attacks.

  2026-05-26 03:09 UTC
• Microsoft Defender vulnerabilities exploited in the wild (CVE-2026 ...
  web:www.helpnetsecurity.com

  Attackers are actively exploiting two Microsoft Defender vulnerabilities ( CVE - 2026 -41091 and CVE - 2026 -45498), Microsoft acknowledged.

  2026-05-26 03:09 UTC

Only Available for Registered Users. Sign in to view.