{"id":"CVE-2026-116119","kind":"vulnerability","aliases":["CVE-2026-116119"],"related":[],"title":"NocoDB: race condition in password-reset flow may allow account takeover","description":"A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack can be executed remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.","summary":"NocoDB up to 2026.08.0 has a race condition in its password-reset flow in users.service.ts, which a remote attacker can trigger. The sources do not state exactly what the attacker gains, so the consequence is unconfirmed beyond the weakness in password reset.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nocodb","node","package","self-hosted"],"not_affected_if":[],"how_to_check":"- Check the installed NocoDB version against `2026.08.0` (unknown whether the fixed version is later)\n- unknown","fix":"- Upgrade NocoDB to a version later than `2026.08.0` once the vendor publishes a fix (unknown which version)\n- unknown","status":"open","published_at":"2026-10-26T05:17:54+00:00","first_seen_at":"2026-10-26T05:28:34+00:00","triaged_at":"2026-10-26T05:29:09+00:00","updated_at":"2026-10-26T05:29:09+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T05:29:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade NocoDB to a version later than `2026.08.0` once the vendor publishes a fix (unknown which version)\n- unknown","reach":"internet","title":"NocoDB: race condition in password-reset flow may allow account takeover","impact":"medium","summary":"NocoDB up to 2026.08.0 has a race condition in its password-reset flow in users.service.ts, which a remote attacker can trigger. The sources do not state exactly what the attacker gains, so the consequence is unconfirmed beyond the weakness in password reset.","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","node"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker may reset or take over another user's account","analyst_note":"Check the NVD entry and the NocoDB repository for the fixed version and the exact impact of the race condition in packages/nocodb/src/services/users/users.service.ts; the vendor has not responded to disclosure.","how_to_check":"- Check the installed NocoDB version against `2026.08.0` (unknown whether the fixed version is later)\n- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Self-hosted or managed NocoDB instances at version 2026.08.0 or earlier that have the password-reset feature reachable. The sources do not say whether the feature must be enabled or whether SSO-only setups are exempt. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3351,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116119':15A,18A '-2026':14A,17A '2026.08.0':28B,76C 'account':11A 'affect':78C 'afterward':117C 'allow':10A 'attack':44B,55B,100C 'beyond':62B 'compon':88C 'condit':3A,32B,98C 'consequ':59B 'contact':121C 'cve':13A,16A 'delet':107C 'disclosur':125C 'earli':122C 'email':127C 'exact':52B 'execut':103C 'explan':116C 'file':84C 'flow':8A,38B,92C 'found':71C 'gain':56B 'github':109C 'host':24B 'issu':110C 'manipul':94C 'may':9A 'nocodb':1A,19B,25B,73C 'node':20B 'packag':21B 'packages/nocodb/src/services/users/users.service.ts':85C 'part':81C 'password':6A,36B,66B,90C 'password-reset':5A,35B,89C 'race':2A,31B,97C 'remot':43B,104C 'reset':7A,37B,67B,91C 'respond':131C 'result':95C 'self':23B 'self-host':22B 'sourc':48B 'state':51B 'takeov':12A 'trigger':46B 'unconfirm':61B 'unknown':80C 'users.service.ts':40B 'vendor':106C,119C 'via':126C 'vulner':69C,113C 'way':134C 'weak':64B 'without':114C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed NocoDB instances at version 2026.08.0 or earlier that have the password-reset feature reachable. The sources do not say whether the feature must be enabled or whether SSO-only setups are exempt. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T05:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116119","severity":null,"published_at":"2026-10-26T05:17:54+00:00","modified_at":"2026-10-26T05:17:54+00:00","first_seen_at":"2026-10-26T05:28:34+00:00","fetched_at":"2026-10-26T05:28:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}