Live › vulnerability › CVE-2026-116121
Go to dashboardNocoDB up to version 2026.08.0 has a race condition in the user registration code path in users.service.ts. A remote attacker can exploit it with high complexity, and the sources do not say what the attacker gains beyond the registration logic being manipulated.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 06:28 UTC. All times on this page are UTC.
Teams that run NocoDB up to and including 2026.08.0 with open user registration reachable from the network are in scope. The sources do not say whether registration must be enabled or whether a default install is exposed, so treat exposure as unknown.
No product ranges from the sources yet.
2026.08.0, for example with the version shown in the admin panel or the Docker image tag.2026.08.0 once the vendor publishes one; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116121")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.