CVE-2026-52887: NocoBase: Unauthenticated SQL Injection Risk in In-App Messages

Summary

NocoBase's in-app messaging feature allows attackers to inject malicious SQL code. This could potentially give an attacker control over a database and allow them to execute unauthorized commands. To fix this issue, update to version 2.0.61 or later.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions
nocobase	nocobase	< 2.0.61

Original title

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /...

Original description

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.

mitre CVSS3.1 10.0

Vulnerability type

CWE-89 SQL Injection

https://github.com/nocobase/nocobase/security/advisories/GHSA-p849-8hwh-84j9 x_refsource_CONFIRM
https://github.com/nocobase/nocobase/commit/68d64e3fcfb8be2ae4f3bfc9e1ee3f85b87c... x_refsource_MISC
https://github.com/nocobase/nocobase/releases/tag/v2.0.61 x_refsource_MISC