API Authentication Flaw in NocoDB Affects User Token Management

CVE-2026-46554

What is CVE-2026-46554?

NocoDB, a platform that enables users to manage databases as spreadsheets, is impacted by an authentication flaw that affects how API tokens are handled. Prior to the update in version 2026.04.4, deleted API tokens remained valid until their cached entry expired, resulting from a failure to invalidate the token in the authentication cache immediately upon deletion. This oversight allowed unauthorized requests to be accepted for up to three days after token deletion. The vulnerability was addressed in the subsequent software update, which improved token revocation processes.

References