Incorrect authorization in NocoDB - #VU162864
Published: November 9, 2026
Vulnerability identifier: #VU162864
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a high-privileged attacker with the base Creator role to remove a higher-ranking Owner from a NocoDB base.
The vulnerability exists due to an ineffective role comparison in base member removal that fails to reject requests targeting higher-ranking members. A high-privileged attacker with the base Creator role can submit a member removal request to revoke an Owner's membership if another Owner remains and the target is not a super administrator.
Affected software
NocoDB
Remediation
Install security update from vendor's website.
NocoDB - update to 2026.09.1