Insecure Direct Object Reference in NocoDB Affects Data Privacy

CVE-2026-126275

What is CVE-2026-126275?

A vulnerability exists in NocoDB prior to version 2026.09.0, which exposes authenticated users to unauthorized access to sensitive data. Specifically, this insecure direct object reference allows users with Viewer or Creator roles on unrelated bases to exploit the application by retrieving private comments and user emails using merely the model and row IDs. Furthermore, attackers can create decoy tables and duplicate comment IDs, leading to potential misinformation and compromised trust among team members. Organizations relying on NocoDB should ensure they upgrade to the latest version to mitigate these risks.

References