Skip to content

nocodb

v2026.06.1 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 1mo Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 4 known CVEs

Topics

airtable airtable-alternative automatic-api low-code no-code no-code-database
+7 more
no-code-platform postgresql rest restful-api spreadsheet sqlite swagger

ReleasePort's take

Moderate signal
editorial:auto 1mo

Row‑Level Security now enforces data filtering for base owners; publicly shared content receives hardened audit controls and strict URL validation.

Why it matters: Owners can no longer bypass RLS filters (severity 80). Publicly shared bases hide audit info, restrict aggregations, and enforce validated redirect URLs (severity 70), reducing exposure risk.

Summary

AI summary

Broad release touches Improvements & Fixes, Closed issues, Self-Hosting, and mailto:[email protected].

Changes in this release

Security High

Row-Level Security now applies to base owners, filtering their data queries.

Row-Level Security now applies to base owners, filtering their data queries.

Source: llm_adapter@2026-06-15

Confidence: high

Security High

Hardened publicly shared content: audit info hidden, filter/agg restrictions, strict redirect URL validation.

Hardened publicly shared content: audit info hidden, filter/agg restrictions, strict redirect URL validation.

Source: llm_adapter@2026-06-15

Confidence: high

Security High

CSV exports now escape values to prevent spreadsheet formula injection.

CSV exports now escape values to prevent spreadsheet formula injection.

Source: llm_adapter@2026-06-15

Confidence: high

Security High

External database connection details are validated at connect time; API responses no longer include sensitive account material.

External database connection details are validated at connect time; API responses no longer include sensitive account material.

Source: llm_adapter@2026-06-15

Confidence: high

Feature Medium

Introduces “Scale” plan between Business and Enterprise, adding unlimited workspaces, Row‑Level Security, audit logs, trash retention, and higher limits.

Introduces “Scale” plan between Business and Enterprise, adding unlimited workspaces, Row‑Level Security, audit logs, trash retention, and higher limits.

Source: llm_adapter@2026-06-15

Confidence: high

Feature Medium

Adds Custom Sync capability mirroring PostgreSQL/MySQL tables as read‑only synced tables.

Adds Custom Sync capability mirroring PostgreSQL/MySQL tables as read‑only synced tables.

Source: llm_adapter@2026-06-15

Confidence: high

Feature Medium

Adds White‑Label add‑on for Enterprise self‑hosted deployments to rebrand the UI and emails.

Adds White‑Label add‑on for Enterprise self‑hosted deployments to rebrand the UI and emails.

Source: llm_adapter@2026-06-15

Confidence: high

Feature Medium

Adds SQL Server support as a connectable database source for grids, views, and Custom Sync.

Adds SQL Server support as a connectable database source for grids, views, and Custom Sync.

Source: llm_adapter@2026-06-15

Confidence: high

Feature Medium

Enables real‑time collaboration in NocoDocs with named cursors, presence avatars, conflict‑free merging, and offline reconciliation.

Enables real‑time collaboration in NocoDocs with named cursors, presence avatars, conflict‑free merging, and offline reconciliation.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Feature Medium

Raises multi‑cell selection limit for copy/paste/fill operations from 100 to 1,000 rows on paid plans.

Raises multi‑cell selection limit for copy/paste/fill operations from 100 to 1,000 rows on paid plans.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Feature Medium

Docker images rebuilt to remediate critical/high severity dependency vulnerabilities; on‑prem image size reduced ~50%.

Docker images rebuilt to remediate critical/high severity dependency vulnerabilities; on‑prem image size reduced ~50%.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Feature Low

Allows conversion of Single line text fields into Links fields with automatic record matching and undoable changes.

Allows conversion of Single line text fields into Links fields with automatic record matching and undoable changes.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Feature Low

Introduces a 3‑Day view layout in the Calendar between Day and Week views.

Introduces a 3‑Day view layout in the Calendar between Day and Week views.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Feature Low

Adds Web bookmark block to NocoDocs for rich visual link cards with title, description, and preview image.

Adds Web bookmark block to NocoDocs for rich visual link cards with title, description, and preview image.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Feature Low

Removes the 50‑filter cap per view and form field conditions on all paid NocoDB Cloud plans (unlimited filters).

Removes the 50‑filter cap per view and form field conditions on all paid NocoDB Cloud plans (unlimited filters).

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Feature Low

New text filters default to “contains” style matching instead of exact match.

New text filters default to “contains” style matching instead of exact match.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Feature Low

Adds on‑page navigation rail in NocoDocs showing heading outline and jump links, including for shared documents.

Adds on‑page navigation rail in NocoDocs showing heading outline and jump links, including for shared documents.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Feature Low

Enables repositioning of cover images and fullscreen image carousel in NocoDocs.

Enables repositioning of cover images and fullscreen image carousel in NocoDocs.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Feature Low

Hide blank fields toggle now also hides Links fields with no linked records.

Hide blank fields toggle now also hides Links fields with no linked records.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Feature Low

Installer script overhauled and Docker Compose examples reorganized with quickstart, Traefik SSL, private‑CA PostgreSQL, managed‑PostgreSQL samples.

Installer script overhauled and Docker Compose examples reorganized with quickstart, Traefik SSL, private‑CA PostgreSQL, managed‑PostgreSQL samples.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Performance Medium

Form editing with 100+ fields now much faster: field switch latency ↓ from ~550 ms to 40 ms; typing latency ↓ from ~380 ms to 90 ms.

Form editing with 100+ fields now much faster: field switch latency ↓ from ~550 ms to 40 ms; typing latency ↓ from ~380 ms to 90 ms.

Source: llm_adapter@2026-06-15

Confidence: high

Performance Low

Grid views restore previous scroll position when revisited instead of jumping to top.

Grid views restore previous scroll position when revisited instead of jumping to top.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Performance Low

Background jobs such as imports continue reporting progress after page refresh.

Background jobs such as imports continue reporting progress after page refresh.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Performance Low

SSO sign‑in flow is smoother and no longer logs users out immediately after login.

SSO sign‑in flow is smoother and no longer logs users out immediately after login.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Bugfix Medium

Photos now display upright respecting EXIF orientation in attachment thumbnails.

Photos now display upright respecting EXIF orientation in attachment thumbnails.

Source: llm_adapter@2026-06-15

Confidence: high

Bugfix Medium

Sync deletion now prompts whether to convert synced tables to editable tables or delete them entirely.

Sync deletion now prompts whether to convert synced tables to editable tables or delete them entirely.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Bugfix Medium

Lookup attachment downloads work reliably again, with proper rendering for nested lookups.

Lookup attachment downloads work reliably again, with proper rendering for nested lookups.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Bugfix Low

Copying URL formula cells pastes as functional links instead of raw formula syntax.

Copying URL formula cells pastes as functional links instead of raw formula syntax.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Bugfix Low

Filter edit UI no longer truncates long lists of selected options beyond 255 characters.

Filter edit UI no longer truncates long lists of selected options beyond 255 characters.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Full changelog

Availability

| Feature | CE / Free | Paid / Enterprise |
|---|:---:|:---:|
| Custom Sync | – | ✅ |
| White-Label | – | Enterprise add-on |
| SQL Server Support | – | Enterprise add-on |

Custom Sync

Custom Sync mirrors tables from your existing PostgreSQL or MySQL database into NocoDB as read-only synced tables that stay up to date with their source, giving business teams a friendly interface over production data without migrations or export scripts. Pick the tables, fine-tune how each column maps to NocoDB field types, and refresh manually or on a schedule with full or incremental runs. Available on the Business plan and above, on both NocoDB Cloud and self-hosted deployments.

Learn more about Custom Sync →

Scale Plan on NocoDB Cloud

Scale is a new NocoDB Cloud plan between Business and Enterprise, bringing governance features to a self-serve plan. It unlocks unlimited workspaces, Row-Level Security, workspace audit logs, and trash retention settings, plus substantially higher limits across records, storage, API calls, automation runs, and retention.

Learn more about plans and pricing →

White-Label

White-Label rebrands your entire NocoDB deployment as your own product. Set your product name, logos, favicon, and brand colour from the new White Label tab in the Admin Panel, and the branding carries through the sign-in page, public forms, shared views, and transactional emails. Available as an add-on for Enterprise customers on self-hosted deployments; reach out to the support team ([email protected]) to enable it.

Learn more about White Label →

SQL Server Support

Microsoft SQL Server joins PostgreSQL and MySQL as a connectable database in NocoDB. Connect it as an external data source and work with it through grids, views, and fields, or use it as a Custom Sync source to mirror tables into your base. Available as an add-on for Enterprise customers; reach out to the support team ([email protected]) to enable it.

Learn more about connecting data sources →

Improvements & Fixes

  • Real-time collaboration in NocoDocs. Multiple people can now edit the same page at once: named cursors, presence avatars, automatic conflict-free merging, and offline edits that reconcile on reconnect. Learn more →
  • Turn text into linked records. Convert a Single line text field into a Links field; cell values are matched to related records by display value, conversions work in both directions and are undoable, and file imports can now map columns directly to Links fields.
  • Calendar 3 Days view. A new layout between Day and Week keeps the next few days in one focused frame, with records ordered by scheduled time and drag-and-drop rescheduling.
  • Web bookmarks in NocoDocs. A new /web bookmark block turns any link into a rich visual card with the page's title, description, and preview image. Learn more →
  • Much faster form building on large forms. Editing forms with 100+ fields is dramatically smoother: switching between fields dropped from roughly 550ms to 40ms, and typing latency fell from roughly 380ms to 90ms.
  • Grid views remember where you left off. Returning to a view restores your previous scroll position instead of jumping back to the top.
  • Select up to 1,000 rows at once. The multi-cell selection limit for copy, paste, and fill operations was raised from 100 to 1,000 rows.
  • Unlimited filters on paid plans. The 50-filter cap per view, which also limited form field conditions, is removed on all paid NocoDB Cloud plans.
  • Text filters now default to "is like". New filters on text, email, URL, and phone fields start with a contains-style match instead of an exact match.
  • On this page navigation in NocoDocs. A subtle heading rail in the page margin shows your position; hover to open the outline and jump to any heading. Works on shared documents too.
  • Cover image repositioning and fullscreen images in NocoDocs. Drag cover banners to reframe them, and open document images in a fullscreen carousel.
  • Safer sync deletion. Deleting a sync now asks whether to convert the synced tables into plain editable tables or delete them along with the sync.
  • Hide blank fields catches empty links. The expanded record's hide-blank toggle now also hides Links fields with no linked records.
  • Copying URL formulas keeps the link. Copying a formula cell that produces a link now pastes as a usable link instead of raw formula syntax.
  • Lookup attachment downloads fixed. Attachments surfaced through Lookup fields download reliably again, and nested lookups render as a proper attachment strip.
  • Filter values are no longer truncated. Editing a filter with many selected options no longer silently drops values beyond 255 characters.
  • Import progress survives a refresh. Background jobs such as imports keep reporting progress after you reload the page.
  • Photos display the right way up. Attachment thumbnails now respect EXIF orientation, so portrait photos no longer render sideways.
  • Smoother SSO sign-in. Signing in through SSO no longer occasionally logs you straight back out.

Security

  • Row-Level Security now applies to base owners. Previously, base owners saw all records regardless of RLS policies. Owners are now filtered like every other role on all data queries, while policy management remains owner-only. If your workflows relied on owners seeing everything, review your policies after upgrading.
  • Hardened publicly shared content. Shared bases no longer expose audit information, shared view requests can no longer reference hidden fields through filters or aggregations, and form redirect URLs are strictly validated.
  • CSV exports protect against spreadsheet formula injection. Exported values that could be interpreted as formulas by spreadsheet applications are now escaped.
  • Stronger safeguards for external database connections. Connection details are validated at connect time, and API responses no longer include sensitive account material.

Self-Hosting

  • Leaner, cleaner Docker images. Published images were rebuilt to remediate all known critical and high severity dependency vulnerabilities, and the on-prem image is roughly half its previous size.
  • Revamped installer and compose examples. The install script was overhauled and the Docker Compose examples reorganized, with new quickstart, Traefik custom-SSL, private-CA PostgreSQL, and managed-PostgreSQL examples.
  • New configuration options. NC_DOCS_REALTIME=false disables the new document collaboration layer, NC_GRID_MAX_SELECTION_LIMIT tunes the grid selection cap, and NC_DISABLE_DB_SSL_FILE_PATHS=true rejects file-path SSL certificate references in external database connections.
  • Better multi-node efficiency. Redis pub/sub connections are now multiplexed through a single listener, reducing overhead on busy multi-instance deployments.

Deprecation Notice

This is the last release to ship pre-built executables. Executables are deprecated and will no longer be published from the next release onwards. If you currently run NocoDB from an executable, switch to Docker or another supported installation method to keep receiving updates.

Closed issues

  • [closed] 🐛 Bug: Gannt view cannot use date time fields as Start and End dates #14047
  • [closed] 🐛 Bug: Gannt view cannot display lookup of lookup field #14046
  • [closed] 🐛 Bug: close dchanged form missing option to leave the box #14015
  • [closed] 🐛 Bug: clear field does not set it to null #14012
  • [closed] 🔦 Feature: filter default for field types #14008
  • [closed] 🔦 Feature: mini calculator for number fields #13998
  • [closed] 🐛 Bug: Shared link groups are not filtering correctly #13984
  • [closed] 🐛 Bug: Not able to Sync or add postgres Databases #13981
  • [closed] 🐛 Bug: Can't sync or add external sources #13966
  • [closed] 🐛 Bug: v0.301.1 - TypeError: Cannot read properties of null (reading 'children') in redoSplitters when navigating to Tables #12869
  • [closed] 🐛 Bug: where clause with condition is/isnot null not working #12704
  • [👋 For : Community or Good First Issue] 🐛 Bug: Image Preview / Thumbnail Incorrect Rotation #10289

Breaking Changes

  • Pre-built executables are deprecated and will no longer be published from the next release.

Security Fixes

  • Row-Level Security now filters base owners like any other role.
  • Publicly shared content no longer exposes audit info, hidden fields via filters/aggregations, or unvalidated redirect URLs.
  • CSV exports escape values that could be interpreted as spreadsheet formulas.
  • External database connection details are validated at connect time and API responses omit sensitive account material.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track nocodb

Get notified when new releases ship.

Sign up free

About nocodb

A Free & Self-hostable Airtable Alternative

All releases →

Related context

Related tools

Earlier breaking changes

  • v2026.05.1 `NC_PUBLIC_URL` environment variable renamed to `NC_SITE_URL` and is now mandatory for self-hosted instances.

Beta — feedback welcome: [email protected]