Information Disclosure Vulnerability in NocoDB by NocoDB

CVE-2026-126292

What is CVE-2026-126292?

NocoDB versions released prior to 2026.06.1 are susceptible to an information disclosure vulnerability found in the profile update handler, located in users.service.ts. This flaw allows an attacker with access to a compromised session to exploit the profile update feature and retrieve sensitive user information, such as password hashes, salts, and session token counters. The vulnerability arises because the user record is returned without proper serialization, leaving critical user information unprotected. By exploiting this weakness, malicious actors can facilitate offline cracking of user passwords, posing a significant risk to user account security. Proper application of user-serialization filters is essential to mitigate this risk and protect confidential data.

References