Information disclosure in NocoDB - #VU162882
Published: November 9, 2026
Vulnerability identifier: #VU162882
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker with a workspace Creator role to obtain every notification webhook credential configured on a NocoDB instance.
The vulnerability exists due to workspace-scoped authorization on the webhook plugin listing endpoint exposing instance-wide administrative configuration without redaction. An authenticated attacker with a workspace Creator role can retrieve plaintext webhook URLs without organization privileges and replay them to post arbitrary messages in the organization's chat channels.
Affected software
NocoDB
Remediation
Install security update from vendor's website.
NocoDB - update to 2026.09.0