CVE-2026-116119

NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route.

NocoDB before 2026.08.0 contains a clickjacking vulnerability because no X-Frame-Options or CSP frame-ancestors headers are sent, allowing any origin to frame the authenticated interface. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.

In NocoDB up to 2026.07.0, the validatePassword function in /auth/user/signup does not adequately restrict excessive authentication attempts. The flaw enables a remote attack of high complexity, and the vendor describes this behavior as intentional. The GitHub issue was deleted without explanation and email contact went unanswered.

In NocoDB up to 2026.07.0, the AuthService.validateUser function in the Sign-in Endpoint component, when the salt argument is manipulated, leads to information disclosure. The attack can be performed remotely, is rated high complexity, and is considered difficult to exploit. The vendor deleted the GitHub issue without explanation and did not respond to email contact.

In NocoDB up to 2026.08.0, unspecified processing in users.service.ts within the Registration component leads to a race condition. The attack can be performed remotely, requires a high level of complexity, and is assessed as difficult to exploit. The vendor deleted the GitHub issue without explanation and did not respond to email contact.

In NocoDB up to 2026.07.0, the UserRefreshToken.deleteAllUserToken function in /auth/user/signup, part of the PublicApiLimiterGuard component, allows uncontrolled resource allocation. The absence of in-app rate limiting on unauthenticated signup and password-forgot endpoints enables a remote attack of high complexity. The vendor considers the limiter pass-through intentional design and deleted the issue without explanation.

NocoDB prior to version 2026.05.1 had a vulnerability that allowed the spreadsheet-import endpoint axiosRequestMake to be used as a generic HTTP proxy. This endpoint was accessible unauthenticated, enabling unauthorized access.

NocoDB prior to version 2026.05.1 had a vulnerability in the base-migration endpoint that accepted a caller-supplied URL without enforcing protocol or destination. This allowed scheme abuse and probing of internal HTTP destinations.

NocoDB prior to version 2026.05.1 allowed authenticated uploaders to deliver .html or .svg attachments that were rendered inline in the browser instead of forcing a download. The issue stemmed from a mismatch in how response headers were handled, leading to automatic rendering of these files.

NocoDB prior to version 2026.05.1 had a vulnerability where a stolen refresh token could be used to mint new JWTs even after the user reset their password. The password forgot flow did not delete all refresh tokens, allowing an attacker to exchange the captured token for a new access token.