Race Condition in NocoDB Password-Reset Component
CVE-2026-116119

5.1MEDIUM

Key Information:

Vendor

NocoDB

Status
Nocodb
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116119?

A vulnerability exists in NocoDB versions up to 2026.08.0 that impacts the Password-Reset Flow component, specifically in the users.service.ts file. This flaw allows attackers to exploit a race condition, potentially leading to unauthorized access or manipulation of user accounts. The issue can be exploited remotely, raising concerns for all NocoDB users. Notably, communication attempts to notify the vendor about this vulnerability went unanswered, and related discussions on GitHub were subsequently deleted without explanation.

Affected Version(s)

NocoDB 2026.08

References

https://vuldb.com/vuln/426187
vdb-entry
https://vuldb.com/vuln/426187/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116119
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ZAST.AI (VulDB User)
VulDB CNA Team
.