CVE-2026-121736Medium· 5.3▾ SunlitNocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_id, redirect_uri and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting.
nocodb >= 0.300.0 < 2026.08.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119715Medium· 4.3NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers
CVE-2026-116122Low· 3.7NocoDB Sign-in Endpoint AuthService.validateUser information disclosure
CVE-2026-116123Low· 3.7NocoDB signup validatePassword excessive authentication
CVE-2026-116119Medium· 5.5NocoDB Password-Reset Flow users.service.ts race condition
CVE-2026-116120Medium· 5.6NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources
CVE-2026-116121Low· 3.7NocoDB Registration users.service.ts race condition