Privilege Escalation Vulnerability in NocoDB by NocoDB Inc.

CVE-2026-126273

What is CVE-2026-126273?

NocoDB versions prior to 2026.09.0 are susceptible to a privilege escalation vulnerability that compromises the administrative integrity of the platform. When the environment variable for the admin password is empty, the system fails to enforce super-admin bootstrap procedures. This oversight permits unauthenticated attackers to exploit the public signup endpoint, inadvertently receiving Creator and Super Admin roles without undergoing the usual verification processes. Consequently, an attacker can gain full administrative control over the NocoDB instance, potentially leading to unauthorized data access, manipulation, or resource exploitation.

References