Weak Password Recovery Mechanism for Forgotten Password in NocoDB - #VU162873
Published: November 9, 2026
Vulnerability identifier: #VU162873
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-640
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker with the base creator role to take over another member's NocoDB account, including a super administrator's.
The vulnerability exists due to unauthorized signup token creation during base invitation resends and token disclosure through member listings when email authentication is enabled. An authenticated attacker with the base creator role can retrieve the token and replace the victim's password without user interaction, gaining the victim's permissions and locking them out.
Affected software
NocoDB
Remediation
Install security update from vendor's website.
NocoDB - update to 2026.10.0