SB20261109117 - Multiple vulnerabilities in NocoDB

Description

This security bulletin contains information about 2 vulnerabilities.

1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a high-privileged attacker with the base Creator role to remove a higher-ranking Owner from a NocoDB base.

The vulnerability exists due to an ineffective role comparison in base member removal that fails to reject requests targeting higher-ranking members. A high-privileged attacker with the base Creator role can submit a member removal request to revoke an Owner's membership if another Owner remains and the target is not a super administrator.

2) Information disclosure (CVE-ID: CVE-2026-126270)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to read instance-wide metadata across all tenants in NocoDB deployments built from public source or installed from npm.

The vulnerability exists due to missing authentication and authorization checks on the aggregated metadata endpoint when processing requests for instance statistics. An unauthenticated remote attacker can request this endpoint to obtain registered user totals and live per-base row counts without victim interaction.

Remediation

Install update from vendor's website.

References

• https://github.com/nocodb/nocodb/security/advisories/GHSA-jmgj-cq6g-6hr2
• https://github.com/nocodb/nocodb/security/advisories/GHSA-5892-3964-gc52