NocoDB presents a database as a spreadsheet style interface, which makes it a common choice for teams that want structured data without writing an application. A ZoomEye query for the application fingerprint records 703 matches.
How the number was obtained
The query was app="NocoDB", run against the ZoomEye index on 29 September 2026 at 02:48 UTC. The unit is a fingerprint match.
Why the interface is the risk
The product connects to an existing database and exposes its tables through a web interface and an API. A user who reaches the interface can typically read and edit the underlying rows, and the interface includes export functions that produce the full table as a file.
Two configurations create most of the exposure. The first is a sign up option that allows anyone who finds the instance to create an account. The second is a share link or a public view that was created for convenience and never revoked.
Because the data arrives from a production database, the sensitivity is inherited. A table used for user records or billing carries the same obligations inside the grid view as it does in the source system.
The count does not distinguish a team tool from a public one
Some of these instances are deliberately reachable, and some belong to a project that ended without the host being cleaned up.
What to check
Disable public sign up unless the deployment is meant to serve external users. Review every shared view and revoke the ones that are no longer needed. Connect the platform with a database account that holds only the permissions the application requires, rather than a database owner account. Enable activity logging, and review exports since a bulk download often precedes an incident report.
References
- ZoomEye search result for app="NocoDB", retrieved 29 September 2026.
- NocoDB documentation: https://docs.nocodb.com/
