SQL Injection Vulnerability in NocoDB by NocoDB Team
CVE-2026-126291

8.7HIGH

Key Information:

Vendor

Nocodb

Status
Nocodb
Vendor
CVE Published:
13 November 2026

What is CVE-2026-126291?

NocoDB versions before 2026.06.2 are susceptible to an SQL injection vulnerability due to improper handling of user-supplied email addresses. The vulnerability occurs in the base-user.cte.utils.ts file, which merges users' email addresses into SQL queries. This flaw allows registered users to manipulate their email inputs, potentially executing arbitrary SQL commands. Consequently, this can result in unauthorized access to sensitive user records, API tokens, and data-source credentials, severely jeopardizing data integrity and confidentiality.

Affected Version(s)

nocodb 0 < 2026.06.2

nocodb 2026.06.2

References

https://github.com/nocodb/nocodb/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/nocodb-before-2026.0...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

PhilipPhil
.