{"id":"CVE-2026-116120","kind":"vulnerability","aliases":["CVE-2026-116120"],"related":[],"title":"NocoDB: signup flow lets remote attackers exhaust resources via token deletion","description":"A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllUserToken of the file /auth/user/signup of the component PublicApiLimiterGuard. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The attack is considered to have high complexity. It is stated that the exploitability is difficult. Code-verified absence of in-app rate limiting on the unauthenticated signup and password-forgot endpoints and per-request refresh/OAuth token invalidation, but the vendor documents the pass-through limiter as intentional design. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.","summary":"NocoDB up to 2026.07.0 lacks in-app rate limiting on its unauthenticated signup and password-forgot endpoints, and deletes all of a user's refresh tokens on each request to /auth/user/signup. The sources say an attacker can cause resource allocation (load) remotely, but the exploit is described as high complexity and difficult.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nocodb","node","package","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the NocoDB version with the deployed image tag or package version; the sources say versions up to and including `2026.07.0` are affected\n- Confirm whether signup is open to the internet on your instance (unknown whether the sources define the exact setting)","fix":"- Upgrade NocoDB past `2026.07.0`; the sources do not name a fixed version\n- Put rate limiting in front of `/auth/user/signup` and the password-forgot endpoint at a reverse proxy or gateway, since the sources say the app does not limit these itself","status":"open","published_at":"2026-10-26T06:17:38+00:00","first_seen_at":"2026-10-26T06:28:44+00:00","triaged_at":"2026-10-26T06:29:32+00:00","updated_at":"2026-10-26T06:29:32+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T06:29:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade NocoDB past `2026.07.0`; the sources do not name a fixed version\n- Put rate limiting in front of `/auth/user/signup` and the password-forgot endpoint at a reverse proxy or gateway, since the sources say the app does not limit these itself","reach":"internet","title":"NocoDB: signup flow lets remote attackers exhaust resources via token deletion","impact":"low","summary":"NocoDB up to 2026.07.0 lacks in-app rate limiting on its unauthenticated signup and password-forgot endpoints, and deletes all of a user's refresh tokens on each request to /auth/user/signup. The sources say an attacker can cause resource allocation (load) remotely, but the exploit is described as high complexity and difficult.","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","node"],"confidence":0.5,"needs_auth":"no","worst_case":"Remote requests exhaust server resources and invalidate users' sessions","analyst_note":"Confirm the fixed NocoDB version and whether the vendor patched the signup or token-deletion logic; the sources say the vendor deleted the issue and did not respond.","how_to_check":"- Check the NocoDB version with the deployed image tag or package version; the sources say versions up to and including `2026.07.0` are affected\n- Confirm whether signup is open to the internet on your instance (unknown whether the sources define the exact setting)","needs_analyst":true,"not_affected_if":["auth-required","managed-hosting"],"who_is_affected":"Self-hosted or managed NocoDB instances on versions up to and including 2026.07.0 where the unauthenticated signup and password-forgot endpoints are reachable from the network. Instances with signup disabled or restricted to an internal network have a smaller exposure, though the sources do not confirm how that setting interacts with the flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000689,"input_tokens":3474,"output_tokens":683,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116120':14A,17A '-2026':13A,16A '/auth/user/signup':56B,96C '2026.07.0':27B,86C 'absenc':135C 'affect':89C 'afterward':182C 'alloc':65B,104C 'app':31B,139C 'attack':6A,61B,108C,117C 'carri':113C 'caus':63B,103C 'code':133C 'code-verifi':132C 'complex':75B,123C 'compon':99C 'consid':119C 'contact':186C 'cve':12A,15A 'delet':11A,44B,172C 'describ':72B 'design':169C 'determin':81C 'difficult':77B,131C 'disclosur':190C 'document':161C 'earli':187C 'email':192C 'endpoint':42B,150C 'exhaust':7A 'explan':181C 'exploit':70B,129C 'file':95C 'flow':3A 'forgot':41B,149C 'function':91C 'github':174C 'high':74B,122C 'host':23B 'in-app':29B,137C 'intent':168C 'invalid':157C 'issu':175C 'lack':28B 'let':4A 'limit':33B,141C,166C 'load':66B 'manipul':102C 'nocodb':1A,18B,24B,83C 'node':19B 'packag':20B 'pass':164C 'pass-through':163C 'password':40B,148C 'password-forgot':39B,147C 'per':153C 'per-request':152C 'possibl':110C 'publicapilimiterguard':100C 'rate':32B,140C 'refresh':50B 'refresh/oauth':155C 'remot':5A,67B,115C 'request':54B,154C 'resourc':8A,64B,106C 'respond':196C 'say':59B 'self':22B 'self-host':21B 'signup':2A,37B,145C 'sourc':58B 'state':126C 'token':10A,51B,156C 'unauthent':36B,144C 'user':48B 'userrefreshtoken.deleteallusertoken':92C 'vendor':160C,171C,184C 'verifi':134C 'via':9A,191C 'vulner':79C,88C,178C 'way':199C 'without':179C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed NocoDB instances on versions up to and including 2026.07.0 where the unauthenticated signup and password-forgot endpoints are reachable from the network. Instances with signup disabled or restricted to an internal network have a smaller exposure, though the sources do not confirm how that setting interacts with the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T06:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116120","severity":null,"published_at":"2026-10-26T06:17:38+00:00","modified_at":"2026-10-26T06:17:38+00:00","first_seen_at":"2026-10-26T06:28:44+00:00","fetched_at":"2026-10-26T06:28:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}