Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-mac7-4t4s-kydz
Vulnerability ID VCID-mac7-4t4s-kydz
Aliases CVE-2022-2063
GHSA-fq4h-m3c8-8m2v
Summary Improper Privilege Management in NocoDB
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-269 Improper Privilege Management
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.01073 https://api.first.org/data/v1/epss?cve=CVE-2022-2063
epss 0.01073 https://api.first.org/data/v1/epss?cve=CVE-2022-2063
epss 0.01073 https://api.first.org/data/v1/epss?cve=CVE-2022-2063
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-fq4h-m3c8-8m2v
cvssv3.1 8.8 https://github.com/nocodb/nocodb
generic_textual HIGH https://github.com/nocodb/nocodb
cvssv3.1 8.8 https://github.com/nocodb/nocodb/commit/269a19c2ad89a0e8a7596498e3806ff2ec1040c2
generic_textual HIGH https://github.com/nocodb/nocodb/commit/269a19c2ad89a0e8a7596498e3806ff2ec1040c2
cvssv3.1 8.8 https://github.com/nocodb/nocodb/pull/2262
generic_textual HIGH https://github.com/nocodb/nocodb/pull/2262
cvssv3.1 8.8 https://github.com/nocodb/nocodb/pull/2337
generic_textual HIGH https://github.com/nocodb/nocodb/pull/2337
cvssv3.1 8.8 https://huntr.dev/bounties/156f405b-21d6-4384-9bff-17ebfe484e20
generic_textual HIGH https://huntr.dev/bounties/156f405b-21d6-4384-9bff-17ebfe484e20
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2022-2063
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-2063
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-2063
https://github.com/nocodb/nocodb
https://github.com/nocodb/nocodb/commit/269a19c2ad89a0e8a7596498e3806ff2ec1040c2
https://github.com/nocodb/nocodb/pull/2262
https://github.com/nocodb/nocodb/pull/2337
https://huntr.dev/bounties/156f405b-21d6-4384-9bff-17ebfe484e20
CVE-2022-2063 https://nvd.nist.gov/vuln/detail/CVE-2022-2063
GHSA-fq4h-m3c8-8m2v https://github.com/advisories/GHSA-fq4h-m3c8-8m2v
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/nocodb/nocodb
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/nocodb/nocodb/commit/269a19c2ad89a0e8a7596498e3806ff2ec1040c2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/nocodb/nocodb/pull/2262
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/nocodb/nocodb/pull/2337
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://huntr.dev/bounties/156f405b-21d6-4384-9bff-17ebfe484e20
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-2063
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.78175
EPSS Score 0.01073
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:31:33.845139+00:00 GHSA Importer Import https://github.com/advisories/GHSA-fq4h-m3c8-8m2v 38.6.0