Information disclosure in NocoDB - CVE-2026-126270
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU162878
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126270
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read instance-wide metadata across all tenants in NocoDB deployments built from public source or installed from npm.
The vulnerability exists due to missing authentication and authorization checks on the aggregated metadata endpoint when processing requests for instance statistics. An unauthenticated remote attacker can request this endpoint to obtain registered user totals and live per-base row counts without victim interaction.
Affected software
NocoDB
How to mitigate CVE-2026-126270
Install security update from vendor's website.
NocoDB - update to 2026.09.1