Live › vulnerability › CVE-2026-116119
Go to dashboardNocoDB up to 2026.08.0 has a race condition in its password-reset flow in users.service.ts, which a remote attacker can trigger. The sources do not state exactly what the attacker gains, so the consequence is unconfirmed beyond the weakness in password reset.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 05:28 UTC. All times on this page are UTC.
Self-hosted or managed NocoDB instances at version 2026.08.0 or earlier that have the password-reset feature reachable. The sources do not say whether the feature must be enabled or whether SSO-only setups are exempt. unknown
No product ranges from the sources yet.
2026.08.0 (unknown whether the fixed version is later)2026.08.0 once the vendor publishes a fix (unknown which version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack can be executed remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116119")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.