Clickjacking Vulnerability in NocoDB Affected by Missing Frame-Control Headers

CVE-2026-119715

What is CVE-2026-119715?

NocoDB versions prior to 2026.08.0 are vulnerable to a clickjacking attack. This vulnerability arises from the absence of X-Frame-Options and CSP frame-ancestors headers, enabling malicious sites to craft an interface that overlays on authenticated sessions. Consequently, an attacker can trick users into performing unintended actions, such as modifying or deleting records, changing sharing settings, or inviting unauthorized collaborators. This threat highlights the importance of implementing proper frame control measures to safeguard user interactions.

References