---
id: "CVE-2026-116121"
kind: "vulnerability"
aliases: ["CVE-2026-116121"]
title: "NocoDB: race condition in user registration may let attackers bypass checks"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["nocodb", "package", "self-hosted", "user-registration"]
not_affected_if: ["unknown"]
published_at: "2026-10-26T06:17:41+00:00"
first_seen_at: "2026-10-26T06:28:44+00:00"
updated_at: "2026-10-26T06:29:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116121", "first_seen_at": "2026-10-26T06:28:44+00:00"}]
---

# NocoDB: race condition in user registration may let attackers bypass checks

NocoDB up to version 2026.08.0 has a race condition in the user registration code path in users.service.ts. A remote attacker can exploit it with high complexity, and the sources do not say what the attacker gains beyond the registration logic being manipulated.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed NocoDB version against `2026.08.0`, for example with the version shown in the admin panel or the Docker image tag.
- unknown

## Fix

- Move to a NocoDB release newer than `2026.08.0` once the vendor publishes one; the sources do not name a fixed version.
- unknown

## Timeline

- 2026-10-26T06:28:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116121

## From the sources

A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_