SB20261109115 - Multiple vulnerabilities in NocoDB

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109115

SB20261109115 - Multiple vulnerabilities in NocoDB

Published: November 9, 2026

Security Bulletin ID SB20261109115
CSH Severity
High
Patch available
YES
Number of vulnerabilities 13
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 8% Medium 31% Low 62%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 13 vulnerabilities.


1) Improper Encoding or Escaping of Output (CVE-ID: N/A)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged attacker to obscure or misrepresent the NocoDB interface and disrupt normal use for users viewing malicious content.

The vulnerability exists due to unescaped single quotes in HTML attributes generated by the rich text and comment renderer when processing unmatched user mentions. A low-privileged attacker can inject interface-altering styles through a comment with the Commenter role or a rich text cell with the Editor role, affecting users who view it.


2) Permissive List of Allowed Inputs (CVE-ID: N/A)

CWE-ID: CWE-183 - Permissive List of Allowed Inputs

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker to capture passwords entered into spoofed sign-in forms within NocoDB.

The vulnerability exists due to permissive HTML sanitization in the rich text cell renderer that retains forms and styling when displaying stored content. An authenticated attacker can edit records in a table containing a rich text field to store a page-sized form overlay that sends passwords to an external address when viewers submit them.


3) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated attacker to take over NocoDB Community Edition instances or access restricted SSO functionality.

The vulnerability exists due to unenforced route role restrictions in authorization middleware when a caller holds another recognized role. A remote authenticated attacker with the organization Creator role can reset the super administrator's password in Community Edition or read SSO client secrets in Enterprise, while the workspace Creator role permits managing SSO clients on NocoDB Cloud.


4) Generation of Predictable Numbers or Identifiers (CVE-ID: N/A)

CWE-ID: CWE-340 - Generation of Predictable Numbers or Identifiers

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read NocoDB data exports, including fields hidden from public shared views.

The vulnerability exists due to predictable export paths served without authentication after a member exports data on installations using local storage with NC_SECURE_ATTACHMENTS disabled. An unauthenticated remote attacker can reconstruct an export path using the table identifier, base, table and view titles, and export time to download the file without a signed link.


5) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with the Creator role on a base to execute operating-system commands with the NocoDB server's privileges.

The vulnerability exists due to string-only prototype access checks in webhook template helpers being bypassed by array-valued property paths. An authenticated attacker with the Creator role on a base can submit and test a crafted webhook template to execute server-side JavaScript.


6) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated attacker to retain access to a victim's NocoDB account after OAuth grant revocation.

The vulnerability exists due to NocoDB's session authentication accepting OAuth access tokens signed with the same secret without checking revocation when submitted through the session header. A remote authenticated attacker holding an unexpired OAuth token from an OAuth or MCP integration can reuse it to modify the victim's profile or force a global sign-out.


7) Insufficiently protected credentials (CVE-ID: N/A)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to extract stored database credentials from NocoDB integrations.

The vulnerability exists due to the connection-test endpoint merging caller-supplied connection targets with stored credentials when testing a saved integration, except for vault-backed Enterprise configurations. A low-privileged remote attacker authorized to access an integration can redirect its connection test to a controlled server and capture authentication exchanges for offline password cracking.


8) Spoofing attack (CVE-ID: N/A)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to obtain persistent read and write access to a victim's tables and records.

The vulnerability exists due to unrestricted OAuth client registration and a consent screen that omits verification status and redirect destinations in NocoDB enterprise and cloud editions. An unauthenticated remote attacker can register a trusted-looking client with an attacker-controlled callback and obtain authorization tokens after a workspace owner approves the deceptive consent screen.


9) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with base schema-edit rights to modify or drop columns in connected MySQL or MariaDB databases.

The vulnerability exists due to inadequate backslash escaping in NocoDB select-field option titles embedded in column definitions under default database SQL modes. An authenticated attacker with base schema-edit rights can submit crafted option titles to inject arbitrary clauses into generated ALTER TABLE statements on sources the base can write to.


10) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read hidden column values from a NocoDB shared view.

The vulnerability exists due to incomplete column visibility checks in the public group-by endpoint when columns are referenced by physical names instead of titles or identifiers. An unauthenticated remote attacker with the share link and its password, if configured, can request grouping by a hidden column to retrieve distinct values and counts within the view's filters.


11) Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CVE-ID: N/A)

CWE-ID: CWE-614 - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated attacker to steal a victim's session token and impersonate the victim until the token expires.

The vulnerability exists due to NocoDB Enterprise's frontend recreating the nc_token cookie without the Secure attribute when the server-issued cookie is absent but the token remains in local storage. An unauthenticated attacker can capture this cookie from an HTTPS deployment by observing or inducing a victim's plain-HTTP request while positioned on the victim's network and while the script-written cookie is present.


12) Observable Response Discrepancy (CVE-ID: N/A)

CWE-ID: CWE-204 - Observable Response Discrepancy

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to identify email addresses associated with pending invited accounts on a NocoDB instance.

The vulnerability exists due to the sign-in endpoint returning a distinct error when an invited account has not completed signup, rather than the generic invalid-credentials error. An unauthenticated remote attacker can submit an email address with an incorrect password and recognize the invitation-specific response to confirm account existence.


13) Observable Response Discrepancy (CVE-ID: N/A)

CWE-ID: CWE-204 - Observable Response Discrepancy

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to identify email addresses associated with NocoDB accounts and, on Enterprise instances, pending invitations.

The vulnerability exists due to differing responses from the sign-up endpoint when submitted email addresses are registered, invited, or unregistered. An unauthenticated remote attacker can submit candidate addresses and compare responses to enumerate users without creating accounts when invite-only signup is enabled.


Remediation

Install update from vendor's website.

References