---
id: "CVE-2026-116123"
kind: "vulnerability"
aliases: ["CVE-2026-116123"]
title: "NocoDB: signup password check lacks limits on repeated authentication attempts"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["nocodb", "package", "self-hosted", "web-apps"]
not_affected_if: ["signup-disabled"]
published_at: "2026-10-26T06:17:41+00:00"
first_seen_at: "2026-10-26T06:28:44+00:00"
updated_at: "2026-10-26T06:29:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116123", "first_seen_at": "2026-10-26T06:28:44+00:00"}]
---

# NocoDB: signup password check lacks limits on repeated authentication attempts

NocoDB up to 2026.07.0 does not properly restrict excessive authentication attempts in the validatePassword function on the /auth/user/signup path. A remote attacker could make many repeated attempts against the signup and password logic, though the sources describe the exploit as difficult and of high complexity.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed NocoDB version and compare it to `2026.07.0`
- unknown

## Fix

- Upgrade NocoDB past `2026.07.0` once a fixed release is published
- unknown

## Timeline

- 2026-10-26T06:28:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116123

## From the sources

A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The vendor documents this as intentional. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_