Live › vulnerability › CVE-2026-121736
NocoDB versions from 0.300.0 before 2026.08.0 expose the POST /api/v2/oauth/authorize endpoint without authentication. An anonymous attacker can insert unlimited ownerless OAuth authorization code records, bounded only by rate limiting.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
NocoDB instances in the affected range that accept requests on the OAuth authorize endpoint, most likely self-hosted deployments reachable from the network. Sources do not describe a non-default configuration that is required; treat any reachable instance in the range as exposed.
No product ranges from the sources yet.
0.300.0 or later but before 2026.08.0/api/v2/oauth/authorize2026.08.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_id, redirect_uri and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting.
This page as .md · .json · in your agent: get_signal("CVE-2026-121736")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.