| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| nocodb | < 2026.05.1 | 2026.05.1 |
A user in one workspace could exercise another workspace's integration through the
testConnection endpoint by supplying its ID, because the integration was fetched in
a bypass scope and the caller's permission check matched any base in any workspace.
The connection-test endpoint fetched the integration in RootScopes.BYPASS scope and
checked only that the integration was non-private and that the caller held an
owner/creator role on any base in any workspace. The permission lookup is now scoped
to the integration's workspace by joining on fk_workspace_id, and the controller
rejects requests where the integration's workspace differs from the request's workspace.
Cross-tenant access to integration configuration through the connection-test endpoint, including the ability to drive the resolved database with the other workspace's credentials. Authentication with creator-or-owner role on any base in any workspace was sufficient.
This issue was reported by @DongyangLyu.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン