SB20261109120 - Multiple vulnerabilities in NocoDB

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109120

SB20261109120 - Multiple vulnerabilities in NocoDB

Published: November 9, 2026 Updated: November 13, 2026

Security Bulletin ID SB20261109120
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with the Creator role on one base to read and modify another tenant's external database without victim-base privileges.

The vulnerability exists due to NocoDB caching database connections by source identifiers shared across bases while accepting caller-supplied identifiers during source creation. An authenticated attacker can reuse a known victim source identifier when adding a source to access the victim database if its connection is cached in the handling process.


2) Improper Authentication (CVE-ID: CVE-2026-126276)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated local attacker to obtain access tokens and 60-day refresh tokens for a confidential OAuth client without its secret.

The vulnerability exists due to NocoDB's OAuth token endpoint treating PKCE as a substitute for client authentication when the client secret is omitted. An unauthenticated local attacker who captures an authorization code and matching PKCE verifier after victim authorization can exchange them for tokens without a NocoDB session.


3) Resource exhaustion (CVE-ID: CVE-2026-126277)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to exhaust CPU and memory and crash the NocoDB process.

The vulnerability exists due to missing filter-array length limits in public shared-view bulk endpoints, which execute a complete data query for every supplied filter. An unauthenticated remote attacker who knows a shared view UUID can submit one POST request with a large filter array to overwhelm a Community Edition instance.


4) Race condition (CVE-ID: CVE-2026-126278)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated attacker to overwrite an account owner's password change and lock the owner out.

The vulnerability exists due to a race condition in NocoDB's password-reset handling that lets concurrent requests validate the same token before it is cleared. An unauthenticated attacker can use a valid, unexpired reset token concurrently with the owner's reset to make the attacker's password take effect despite the owner receiving a successful response.


Remediation

Install update from vendor's website.

References