{"uuid": "a7e4e904-0212-47ef-8b84-580c696162b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52888", "type": "seen", "source": "https://gist.github.com/alon710/f64be2d49b2d7a1297c03bef66babfa4", "content": "# CVE-2026-52888: CVE-2026-52888: Sensitive Data Exposure and Blacklist Bypass in NocoBase SQL Collection Plugin\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-52888\n\n## Summary\nNocoBase, an extensible low-code platform, was found to contain an information exposure vulnerability in its SQL Collection plugin. The validator designed to inspect SQL queries used an incomplete keyword-based blacklist, allowing users with administrative or collection creation privileges to bypass restrictions and execute arbitrary SELECT queries against PostgreSQL system catalogs. This flaw permits unauthenticated or privilege-escalated access to critical system files, active connection listings, and system user password hashes.\n\n## TL;DR\nNocoBase versions prior to 2.1.0-alpha.46 used an incomplete blacklist in checkSQL() validator, enabling privileged users to read system databases, query schema metadata, and extract PostgreSQL MD5/SCRAM password hashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-184\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 6.8\n- **EPSS Score**: 0.00269\n- **Exploit Maturity**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- NocoBase low-code/no-code platform\n- NocoBase SQL Collection Plugin (@nocobase/plugin-collection-sql)\n- **@nocobase/plugin-collection-sql**: <= 2.0.59 (Fixed in: `2.1.0-alpha.46`)\n\n## Mitigation\n\n- Upgrade NocoBase installation to version 2.1.0-alpha.46, 2.0.62, or later.\n- Enforce Least Privilege (least-privilege database user configurations) to prevent access to the system catalog.\n- Revoke access rights on 'pg_shadow' and 'pg_authid' tables for the NocoBase connection user.\n\n**Remediation Steps:**\n1. Identify all active NocoBase deployments utilizing PostgreSQL backends.\n2. Apply the patch using the official repository updates or upgrade the Docker container image to tag v2.0.62.\n3. Modify database privileges so that the database user account does not possess 'superuser' or 'rds_superuser' privileges.\n4. Audit active database tables for exposed application tokens and rotate database credentials.\n\n## References\n\n- [NocoBase Security Advisory GHSA-v8vm-cqh8-q87q](https://github.com/nocobase/nocobase/security/advisories/GHSA-v8vm-cqh8-q87q)\n- [NocoBase Patch Commit 87c5489](https://github.com/nocobase/nocobase/commit/87c548969ce9258dd7f0d9571c9453ae10bc3fc4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-52888) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-28T21:31:27.843543Z"}