Improper Privilege Management in NocoDB by NocoDB

CVE-2026-126282

What is CVE-2026-126282?

NocoDB versions 2026.04.0 through 2026.07.0 are affected by an improper privilege management issue that occurs in org-users.service.ts. This vulnerability allows revoked users to seamlessly regain Creator-level access, which includes read, write, and schema modification capabilities across default-workspace bases, using their existing session tokens. When updating a user's legacy organization role, their default-workspace role can be inadvertently overwritten, leading to unauthorized access and potential data manipulation.

References