Live › vulnerability › CVE-2026-116123
Go to dashboardNocoDB up to 2026.07.0 does not properly restrict excessive authentication attempts in the validatePassword function on the /auth/user/signup path. A remote attacker could make many repeated attempts against the signup and password logic, though the sources describe the exploit as difficult and of high complexity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 06:28 UTC. All times on this page are UTC.
Teams that run NocoDB 2026.07.0 or earlier with the signup endpoint reachable from the network are in scope. The sources say the vendor treats the behavior as intentional and has not responded to early disclosure, so no fixed release is confirmed. Teams using managed hosting or with signup disabled may be less exposed, but the sources do not confirm this.
No product ranges from the sources yet.
2026.07.02026.07.0 once a fixed release is publishedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The vendor documents this as intentional. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116123")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.