Information Disclosure Vulnerability in NocoDB Sign-in Endpoint
CVE-2026-116122

6.3MEDIUM

Key Information:

Vendor

NocoDB

Status
Nocodb
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116122?

A security flaw has been identified in NocoDB affecting versions up to 2026.07.0. The vulnerability resides in the AuthService.validateUser function of the Sign-in Endpoint. By manipulating the 'salt' argument, an attacker may exploit this vulnerability to gain unauthorized access to sensitive information. This exploitation can be performed remotely, making it a significant concern for users. Despite being notified about this vulnerability, the vendor has not responded and has removed the related GitHub issue without any clarification.

Affected Version(s)

NocoDB 2026.07

References

https://vuldb.com/vuln/426190
vdb-entrytechnical-description
https://vuldb.com/vuln/426190/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116122
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ZAST.AI (VulDB User)
VulDB CNA Team
.