Information Disclosure Vulnerability in NocoDB by NocoDB Team

CVE-2026-126270

What is CVE-2026-126270?

NocoDB versions prior to 2026.09.1 contain a missing authentication vulnerability that can be exploited through the aggregated meta info endpoint in utils.controller.ts. This flaw enables unauthenticated individuals to access sensitive instance-wide metadata, including the ability to enumerate bases, user counts, shared view counts, password-protected view counts, webhook counts, and live per-base row counts. The exposure of such information can facilitate further attacks and increase database query load due to repeated unauthorized requests.

References