---
id: "CVE-2026-116119"
kind: "vulnerability"
aliases: ["CVE-2026-116119"]
title: "NocoDB: race condition in password-reset flow may allow account takeover"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["nocodb", "node", "package", "self-hosted"]
not_affected_if: []
published_at: "2026-10-26T05:17:54+00:00"
first_seen_at: "2026-10-26T05:28:34+00:00"
updated_at: "2026-10-26T05:29:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116119", "first_seen_at": "2026-10-26T05:28:34+00:00"}]
---

# NocoDB: race condition in password-reset flow may allow account takeover

NocoDB up to 2026.08.0 has a race condition in its password-reset flow in users.service.ts, which a remote attacker can trigger. The sources do not state exactly what the attacker gains, so the consequence is unconfirmed beyond the weakness in password reset.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed NocoDB version against `2026.08.0` (unknown whether the fixed version is later)
- unknown

## Fix

- Upgrade NocoDB to a version later than `2026.08.0` once the vendor publishes a fix (unknown which version)
- unknown

## Timeline

- 2026-10-26T05:28:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116119

## From the sources

A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack can be executed remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_