Information Disclosure in NocoDB Affects Client Records

CVE-2026-126288

What is CVE-2026-126288?

An information disclosure vulnerability has been identified in NocoDB prior to version 2026.06.2. This vulnerability allows unauthenticated attackers to access sensitive OAuth client records by exploiting the public client lookup endpoint in the oauth.controller.ts file. If an attacker knows or can guess a valid client identifier, they can retrieve critical registration information, including the access token needed to alter or delete registrations, as well as the hashed client secret and the owner’s internal identifier, leading to unauthorized access and potential manipulation of client data.

References