{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.301.3"}],"component":"nocodb","cve_ids":["CVE-2026-46549"],"ecosystem":"npm","epss":0.00241,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-m5qg-rvjq-727p","id":"tcs_01M5KFZQ2A4BP9F9T19N11NJBK","modified_at":"2026-07-20T21:30:39.522929877Z","published_at":"2026-05-21T20:34:51Z","references":["https://osv.dev/vulnerability/GHSA-m5qg-rvjq-727p","https://github.com/nocodb/nocodb/security/advisories/GHSA-m5qg-rvjq-727p","https://nvd.nist.gov/vuln/detail/CVE-2026-46549","https://github.com/nocodb/nocodb"],"severity":{"label":"low","score":2},"sources":[{"source":"osv","source_id":"GHSA-m5qg-rvjq-727p","url":"https://osv.dev/vulnerability/GHSA-m5qg-rvjq-727p"}],"summary":"NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation"}