Information Disclosure in NocoDB Affects Base Integration Configurations

CVE-2026-126290

What is CVE-2026-126290?

NocoDB versions prior to 2026.07.0 are susceptible to an information disclosure vulnerability located in the base-integrations.service.ts file. This flaw enables authenticated base members to access private integration configurations without proper authorization by omitting a necessary query flag. In doing so, attackers can circumvent the ownership verification process, allowing them to retrieve stored connection credentials from another user's private integration configurations.

References