Information disclosure in NocoDB - #VU162870
Published: November 9, 2026
Vulnerability identifier: #VU162870
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated workspace viewer to claim an invited account and escalate to workspace owner.
The vulnerability exists due to raw invitation tokens being exposed in the workspace member list in affected NocoDB Community Edition deployments outside the official Docker image. An authenticated workspace viewer can retrieve and redeem a token at signup when an unexpired higher-privileged invitation exists, obtaining the invitation's assigned role without proving they are the intended recipient.
Affected software
NocoDB
Remediation
Install security update from vendor's website.
NocoDB - update to 2026.10.0