Race Condition Vulnerability in NocoDB Registration Component
CVE-2026-116121

6.3MEDIUM

Key Information:

Vendor

NocoDB

Status
Nocodb
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116121?

A vulnerability was discovered in NocoDB that impacts the processing associated with the users.service.ts file in the Registration component. This issue allows for potential race condition exploits that can be executed remotely. Due to the complexity of the required steps, the exploitation of this vulnerability poses challenges. Despite notification of the issue, the vendor has not responded, and GitHub discussions regarding this vulnerability have been deleted without clarification. This lack of communication raises concerns about transparency and promptness in addressing security threats.

Affected Version(s)

NocoDB 2026.08

References

https://vuldb.com/vuln/426189
vdb-entry
https://vuldb.com/vuln/426189/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116121
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ZAST.AI (VulDB User)
VulDB CNA Team
.