Resource Allocation Vulnerability in NocoDB by NocoDB

CVE-2026-116120

What is CVE-2026-116120?

A resource allocation vulnerability has been identified in NocoDB versions up to 2026.07.0, specifically within the UserRefreshToken.deleteAllUserToken function of the PublicApiLimiterGuard component. This vulnerability results from the lack of rate limiting on unauthenticated signup and password-forgot endpoints, potentially leading to exploitation that consumes excessive resources. Although the attack can be executed remotely, it requires a complex approach for successful execution. The vendor's documentation misleadingly describes the absence of in-app rate limiting as an intentional design choice. Additionally, attempts to address the reported vulnerability have gone unanswered, exemplified by the removal of the related GitHub issue without clarification.

References