Incorrect authorization in NocoDB - #VU162861
Published: November 9, 2026
Vulnerability identifier: #VU162861
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to take over NocoDB Community Edition instances or access restricted SSO functionality.
The vulnerability exists due to unenforced route role restrictions in authorization middleware when a caller holds another recognized role. A remote authenticated attacker with the organization Creator role can reset the super administrator's password in Community Edition or read SSO client secrets in Enterprise, while the workspace Creator role permits managing SSO clients on NocoDB Cloud.
Affected software
NocoDB
Remediation
Install security update from vendor's website.
NocoDB - update to 2026.10.1