{"id":"CVE-2026-116121","kind":"vulnerability","aliases":["CVE-2026-116121"],"related":[],"title":"NocoDB: race condition in user registration may let attackers bypass checks","description":"A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.","summary":"NocoDB up to version 2026.08.0 has a race condition in the user registration code path in users.service.ts. A remote attacker can exploit it with high complexity, and the sources do not say what the attacker gains beyond the registration logic being manipulated.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nocodb","package","self-hosted","user-registration"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed NocoDB version against `2026.08.0`, for example with the version shown in the admin panel or the Docker image tag.\n- unknown","fix":"- Move to a NocoDB release newer than `2026.08.0` once the vendor publishes one; the sources do not name a fixed version.\n- unknown","status":"open","published_at":"2026-10-26T06:17:41+00:00","first_seen_at":"2026-10-26T06:28:44+00:00","triaged_at":"2026-10-26T06:29:31+00:00","updated_at":"2026-10-26T06:29:32+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T06:29:31Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a NocoDB release newer than `2026.08.0` once the vendor publishes one; the sources do not name a fixed version.\n- unknown","reach":"internet","title":"NocoDB: race condition in user registration may let attackers bypass checks","impact":"medium","summary":"NocoDB up to version 2026.08.0 has a race condition in the user registration code path in users.service.ts. A remote attacker can exploit it with high complexity, and the sources do not say what the attacker gains beyond the registration logic being manipulated.","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","user-registration"],"confidence":0.5,"needs_auth":"no","worst_case":"unknown; the sources describe a race condition in registration logic only","analyst_note":"Find the NVD entry's affected version range and the exact impact of the race in users.service.ts, and check whether the vendor has released a fix; the vendor reportedly did not respond to disclosure.","how_to_check":"- Check the installed NocoDB version against `2026.08.0`, for example with the version shown in the admin panel or the Docker image tag.\n- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that run NocoDB up to and including 2026.08.0 with open user registration reachable from the network are in scope. The sources do not say whether registration must be enabled or whether a default install is exposed, so treat exposure as unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000606,"input_tokens":3365,"output_tokens":538,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116121':14A,17A '-2026':13A,16A '2026.08.0':30B,76C 'affect':79C 'afterward':130C 'assess':115C 'attack':9A,45B,60B,98C,105C 'beyond':62B 'bypass':10A 'check':11A 'code':39B 'complex':51B,111C 'compon':89C 'condit':3A,34B,96C 'contact':134C 'cve':12A,15A 'delet':120C 'difficult':117C 'disclosur':138C 'earli':135C 'email':140C 'explan':129C 'exploit':47B,113C 'file':85C 'gain':61B 'github':122C 'high':50B,108C 'host':22B 'identifi':71C 'issu':78C,123C 'lead':93C 'let':8A 'level':109C 'logic':65B 'manipul':67B,92C 'may':7A,99C 'nocodb':1A,18B,26B,73C 'packag':19B 'path':40B 'perform':101C 'process':82C 'race':2A,33B,95C 'registr':6A,25B,38B,64B,90C 'remot':44B,103C 'requir':106C 'respond':144C 'say':57B 'self':21B 'self-host':20B 'sourc':54B 'unknown':81C 'user':5A,24B,37B 'user-registr':23B 'users.service.ts':42B,86C 'vendor':119C,132C 'version':29B 'via':139C 'vulner':69C,126C 'way':147C 'without':127C","nicknames":[],"mitigations":[],"who_affected":"Teams that run NocoDB up to and including 2026.08.0 with open user registration reachable from the network are in scope. The sources do not say whether registration must be enabled or whether a default install is exposed, so treat exposure as unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T06:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116121","severity":null,"published_at":"2026-10-26T06:17:41+00:00","modified_at":"2026-10-26T06:17:41+00:00","first_seen_at":"2026-10-26T06:28:44+00:00","fetched_at":"2026-10-26T06:28:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}