Missing Authorization Vulnerability in NocoDB by NocoDB

CVE-2026-126281

What is CVE-2026-126281?

NocoDB prior to version 2026.08.0 has a missing authorization flaw that allows authenticated users with the Creator role to exploit the copy-from feature in integrations.service.ts. This vulnerability permits these users to decrypt and access connection credentials of other users' private integrations without verifying their ownership or private status. As a result, sensitive information such as database host, username, and password can be compromised. Organizations using NocoDB should be aware of this vulnerability to enhance their security posture.

References