{"id":"CVE-2026-116123","kind":"vulnerability","aliases":["CVE-2026-116123"],"related":[],"title":"NocoDB: signup password check lacks limits on repeated authentication attempts","description":"A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The vendor documents this as intentional. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.","summary":"NocoDB up to 2026.07.0 does not properly restrict excessive authentication attempts in the validatePassword function on the /auth/user/signup path. A remote attacker could make many repeated attempts against the signup and password logic, though the sources describe the exploit as difficult and of high complexity.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nocodb","package","self-hosted","web-apps"],"not_affected_if":["signup-disabled"],"how_to_check":"- Check the installed NocoDB version and compare it to `2026.07.0`\n- unknown","fix":"- Upgrade NocoDB past `2026.07.0` once a fixed release is published\n- unknown","status":"open","published_at":"2026-10-26T06:17:41+00:00","first_seen_at":"2026-10-26T06:28:44+00:00","triaged_at":"2026-10-26T06:29:31+00:00","updated_at":"2026-10-26T06:29:31+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T06:29:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade NocoDB past `2026.07.0` once a fixed release is published\n- unknown","reach":"internet","title":"NocoDB: signup password check lacks limits on repeated authentication attempts","impact":"low","summary":"NocoDB up to 2026.07.0 does not properly restrict excessive authentication attempts in the validatePassword function on the /auth/user/signup path. A remote attacker could make many repeated attempts against the signup and password logic, though the sources describe the exploit as difficult and of high complexity.","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","web-apps"],"confidence":0.5,"needs_auth":"no","worst_case":"Remote attacker makes many signup password attempts without being throttled.","analyst_note":"Confirm whether a fixed version exists and whether the signup endpoint is enabled by default, using the NVD entry and the NocoDB repository.","how_to_check":"- Check the installed NocoDB version and compare it to `2026.07.0`\n- unknown","needs_analyst":true,"not_affected_if":["signup-disabled"],"who_is_affected":"Teams that run NocoDB 2026.07.0 or earlier with the signup endpoint reachable from the network are in scope. The sources say the vendor treats the behavior as intentional and has not responded to early disclosure, so no fixed release is confirmed. Teams using managed hosting or with signup disabled may be less exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000614,"input_tokens":3388,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116123':13A,16A '-2026':12A,15A '/auth/user/signup':42B,90C '2026.07.0':28B,79C 'affect':81C 'afterward':142C 'app':24B 'attack':46B,109C,112C 'attempt':10A,35B,51B,102C 'authent':9A,34B,101C 'character':114C 'check':4A 'complex':69B,117C 'contact':146C 'could':47B 'cve':11A,14A 'delet':132C 'describ':61B,121C 'difficult':65B,123C 'disclosur':150C 'document':126C 'earli':147C 'element':82C 'email':152C 'excess':33B,100C 'execut':91C 'explan':141C 'exploit':63B,119C 'file':89C 'function':39B,85C 'github':134C 'high':68B,116C 'host':21B 'identifi':74C 'improp':97C 'intent':129C 'issu':135C 'lack':5A 'launch':107C 'lead':95C 'limit':6A 'logic':57B 'make':48B 'mani':49B 'manipul':93C 'nocodb':1A,17B,25B,76C 'packag':18B 'password':3A,56B 'path':43B 'possibl':105C 'proper':31B 'remot':45B,110C 'repeat':8A,50B 'respond':156C 'restrict':32B,98C 'self':20B 'self-host':19B 'signup':2A,54B 'sourc':60B 'though':58B 'validatepassword':38B,86C 'vendor':125C,131C,144C 'via':151C 'vulner':138C 'way':159C 'weak':71C 'web':23B 'web-app':22B 'without':139C","nicknames":[],"mitigations":[],"who_affected":"Teams that run NocoDB 2026.07.0 or earlier with the signup endpoint reachable from the network are in scope. The sources say the vendor treats the behavior as intentional and has not responded to early disclosure, so no fixed release is confirmed. Teams using managed hosting or with signup disabled may be less exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T06:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116123","severity":null,"published_at":"2026-10-26T06:17:41+00:00","modified_at":"2026-10-26T06:17:41+00:00","first_seen_at":"2026-10-26T06:28:44+00:00","fetched_at":"2026-10-26T06:28:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}