SB20261109119 - Multiple vulnerabilities in NocoDB

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109119

SB20261109119 - Multiple vulnerabilities in NocoDB

Published: November 9, 2026 Updated: November 13, 2026

Security Bulletin ID SB20261109119
CSH Severity
High
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 10% Medium 30% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2026-126269)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated attacker to execute same-origin scripts in NocoDB and impersonate a victim by stealing their session token.

The vulnerability exists due to substring matching in the attachment preview MIME allow-list, allowing crafted MIME values to serve HTML inline from NocoDB's origin. An authenticated attacker with a base Editor role or above can store a malicious attachment through the records API that executes when a victim opens it in the application or follows its signed link.


2) Insufficiently protected credentials (CVE-ID: CVE-2026-126271)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated attacker with base Viewer access to obtain TLS client credentials for a base's external database.

The vulnerability exists due to incomplete credential masking in NocoDB's data source read response when the source uses TLS client-certificate authentication. A remote authenticated attacker with base Viewer access can read the source configuration and use the exposed credentials to authenticate directly to databases accepting client certificates, bypassing NocoDB permissions.


3) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a privileged remote attacker to execute operating-system commands on an external PostgreSQL database host.

The vulnerability exists due to NocoDB's formula query builder interpolating function names from stored, attacker-controlled parsed trees into SQL without revalidation. A privileged remote attacker with a base Creator or Owner role can plant a malicious tree on a single-container SQLite metadata installation and trigger command execution when the connected PostgreSQL role permits server programs.


4) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with a workspace Creator role to obtain every notification webhook credential configured on a NocoDB instance.

The vulnerability exists due to workspace-scoped authorization on the webhook plugin listing endpoint exposing instance-wide administrative configuration without redaction. An authenticated attacker with a workspace Creator role can retrieve plaintext webhook URLs without organization privileges and replay them to post arbitrary messages in the organization's chat channels.


5) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: N/A)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with the Creator or Owner base role to execute operating-system commands with the NocoDB server's privileges.

The vulnerability exists due to webhook template helpers resolving attacker-controlled property paths outside Handlebars prototype-access protections when rendering crafted templates. An authenticated attacker with the Creator or Owner base role can create or update a malicious webhook template to execute arbitrary JavaScript in the server process when rendered.


6) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-126272)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with a base Editor role on at least one table to cause resource-exhaustion denial of service in NocoDB.

The vulnerability exists due to missing row-count enforcement for session-authenticated requests to bulk record write endpoints, which enforce this limit only for API-token authentication. An authenticated attacker can repeatedly submit oversized record arrays through a browser session, exhausting database connections, CPU, and memory.


7) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read another user's background job status and exported data in NocoDB.

The vulnerability exists due to missing authorization on the job status polling endpoint, which returns buffered messages when supplied with an unguessable job identifier. An unauthenticated remote attacker can submit a known job identifier during execution or about a minute afterward to obtain a signed export URL and download the data without further authentication.


8) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated user with at least Viewer access to one NocoDB base to read another base's metadata without access to that base.

The vulnerability exists due to request middleware accepting a query-string MCP token identifier to select the authorization base while retaining the path's data base. An authenticated user can supply their own base's token identifier to retrieve a target base's table list and member email addresses.


9) Improper privilege management (CVE-ID: CVE-2026-126273)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated attacker to gain full administrative control of a fresh, non-cloud NocoDB deployment during initial setup.

The vulnerability exists due to administrator bootstrap being silently skipped when the admin email is configured but the admin password is empty, leaving first-user registration open. An unauthenticated attacker can register through the public signup endpoint before any user account exists and receive Super Admin privileges.


10) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-126275)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker to read private row comments and author email addresses from NocoDB bases they cannot access.

The vulnerability exists due to row comment queries using caller-supplied table and row identifiers without binding results to the base authorized for the request. An authenticated attacker with Viewer access to an unrelated base can submit victim identifiers obtained from a public shared view to retrieve those comments without victim interaction.


Remediation

Install update from vendor's website.

References