NocoDB vulnerabilities
CVEs whose affected-version data names the NocoDB package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
10 CVEsRSS
CVE-2026-116122Low· 3.7NocoDB Sign-in Endpoint AuthService.validateUser information disclosure
A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is p…
CVE-2026-116123Low· 3.7NocoDB signup validatePassword excessive authentication
A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts…
CVE-2026-116119Medium· 5.5NocoDB Password-Reset Flow users.service.ts race condition
A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attac…
CVE-2026-116120Medium· 5.6NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources
A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllUserToken of the file /auth/user/signup of the component PublicApiLimiterGuard. This manipulation causes allocati…
CVE-2026-116121Low· 3.7NocoDB Registration users.service.ts race condition
A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from …
CVE-2026-53927MediumNocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
CVE-2026-53928MediumNocoDB: Refresh Tokens Persist Through Password Recovery
NocoDB: Refresh Tokens Persist Through Password Recovery
CVE-2026-53929MediumNocoDB: Stored Cross-Site Scripting via Secure Attachment
NocoDB: Stored Cross-Site Scripting via Secure Attachment
CVE-2026-53930MediumNocoDB: Server-Side Request Forgery via Base Migration URL
NocoDB: Server-Side Request Forgery via Base Migration URL
CVE-2026-53931MediumNocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint