Live › vulnerability › CVE-2026-119715
NocoDB before 2026.08.0 does not send X-Frame-Options or CSP frame-ancestors headers, so any website can embed its interface. An attacker can overlay a signed-in user's session and trick clicks that delete records, change sharing or invite collaborators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Teams that self-host or run NocoDB and have signed-in users who open untrusted websites in the same browser. Exposure depends on the instance serving the UI without frame-blocking headers, which the description says is the default for affected versions. Instances on managed hosting or behind a proxy that adds frame-ancestors headers may not be exposed, but the sources do not confirm this.
No product ranges from the sources yet.
2026.08.0 are affected.X-Frame-Options or a Content-Security-Policy containing frame-ancestors; if neither is present, framing is not blocked.2026.08.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.
This page as .md · .json · in your agent: get_signal("CVE-2026-119715")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.