CVE-2026-126269 · Other
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.09.0 lets an authenticated Editor store a crafted attachment MIME type such as text/html;image/png, so the /dltemp signed URL serves HTML inline. Script running in that page can read session tokens from localStorage and impersonate other users.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted or managed NocoDB instances before 2026.09.0 where users have the Editor role and can upload attachments. The attack needs an authenticated Editor account and the /dltemp signed URL being opened by another user, such as an admin, in a browser. Instances with only Viewer or admin accounts, or no attachment use, are less exposed.
Not affected if no-editor-users, version-2026.09.0-or-later
Who cares nocodb, self-hosted
2026.09.0.2026.09.0 or later, per the NVD range.NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML inline, stealing session tokens from localStorage to impersonate victims.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.