---
id: "CVE-2026-119715"
kind: "vulnerability"
aliases: ["CVE-2026-119715"]
title: "NocoDB: missing frame protection lets any site overlay signed-in sessions"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["nocodb", "other", "self-hosted"]
not_affected_if: ["managed-hosting", "proxy-adds-frame-headers"]
published_at: "2026-10-30T16:17:54+00:00"
first_seen_at: "2026-10-30T16:31:26+00:00"
updated_at: "2026-10-30T16:32:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119715", "first_seen_at": "2026-10-30T16:31:26+00:00"}]
---

# NocoDB: missing frame protection lets any site overlay signed-in sessions

NocoDB before 2026.08.0 does not send X-Frame-Options or CSP frame-ancestors headers, so any website can embed its interface. An attacker can overlay a signed-in user's session and trick clicks that delete records, change sharing or invite collaborators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the NocoDB version with the instance's about or version page; versions before `2026.08.0` are affected.
- Inspect response headers from the NocoDB URL for `X-Frame-Options` or a `Content-Security-Policy` containing `frame-ancestors`; if neither is present, framing is not blocked.

## Fix

- NocoDB: move to `2026.08.0` or later.

## Timeline

- 2026-10-30T16:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119715

## From the sources

NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_