Authorization bypass through user-controlled key in NocoDB - #VU162886
Published: November 9, 2026
Vulnerability identifier: #VU162886
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated user with at least Viewer access to one NocoDB base to read another base's metadata without access to that base.
The vulnerability exists due to request middleware accepting a query-string MCP token identifier to select the authorization base while retaining the path's data base. An authenticated user can supply their own base's token identifier to retrieve a target base's table list and member email addresses.
Affected software
NocoDB
Remediation
Install security update from vendor's website.
NocoDB - update to 2026.09.0