Race Condition Vulnerability in NocoDB by NocoDB Inc.

CVE-2026-126278

What is CVE-2026-126278?

NocoDB versions prior to 2026.08.1 exhibit a race condition vulnerability located in the users.service.ts file. This issue permits authorized users holding a valid password reset token to execute multiple password resets simultaneously by issuing concurrent reset requests. Exploiting this vulnerability allows attackers to take advantage of the time it takes for bcrypt hashing to complete, enabling them to potentially overwrite the newly set password of the account holder, thereby locking them out. This flaw emphasizes the need for robust security practices, particularly surrounding token handling and password management.

References