---
id: "CVE-2026-116120"
kind: "vulnerability"
aliases: ["CVE-2026-116120"]
title: "NocoDB: signup flow lets remote attackers exhaust resources via token deletion"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["nocodb", "node", "package", "self-hosted"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-26T06:17:38+00:00"
first_seen_at: "2026-10-26T06:28:44+00:00"
updated_at: "2026-10-26T06:29:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116120", "first_seen_at": "2026-10-26T06:28:44+00:00"}]
---

# NocoDB: signup flow lets remote attackers exhaust resources via token deletion

NocoDB up to 2026.07.0 lacks in-app rate limiting on its unauthenticated signup and password-forgot endpoints, and deletes all of a user's refresh tokens on each request to /auth/user/signup. The sources say an attacker can cause resource allocation (load) remotely, but the exploit is described as high complexity and difficult.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the NocoDB version with the deployed image tag or package version; the sources say versions up to and including `2026.07.0` are affected
- Confirm whether signup is open to the internet on your instance (unknown whether the sources define the exact setting)

## Fix

- Upgrade NocoDB past `2026.07.0`; the sources do not name a fixed version
- Put rate limiting in front of `/auth/user/signup` and the password-forgot endpoint at a reverse proxy or gateway, since the sources say the app does not limit these itself

## Timeline

- 2026-10-26T06:28:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116120

## From the sources

A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllUserToken of the file /auth/user/signup of the component PublicApiLimiterGuard. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The attack is considered to have high complexity. It is stated that the exploitability is difficult. Code-verified absence of in-app rate limiting on the unauthenticated signup and password-forgot endpoints and per-request refresh/OAuth token invalidation, but the vendor documents the pass-through limiter as intentional design. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_