{"id":"CVE-2026-126270","kind":"vulnerability","aliases":["CVE-2026-126270"],"related":[],"title":"NocoDB: unauthenticated route exposes instance metadata and row counts","description":"NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load.","summary":"NocoDB before 2026.09.1 has an aggregated meta info route in utils.controller.ts that skips authentication. An anonymous caller can read instance-wide counts of bases, users, views, webhooks and per-base rows, and repeated requests can load the database.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["databases","nocodb","package","self-hosted"],"not_affected_if":["patched-version"],"how_to_check":null,"fix":"- NocoDB: move to `2026.09.1` or later","status":"open","published_at":"2026-11-13T10:17:29+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","triaged_at":"2026-11-13T10:54:51+00:00","updated_at":"2026-11-13T10:54:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:54:51Z","model":"claude-haiku-5-5","output":{"fix":"- NocoDB: move to `2026.09.1` or later","reach":"internet","title":"NocoDB: unauthenticated route exposes instance metadata and row counts","impact":"low","summary":"NocoDB before 2026.09.1 has an aggregated meta info route in utils.controller.ts that skips authentication. An anonymous caller can read instance-wide counts of bases, users, views, webhooks and per-base rows, and repeated requests can load the database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","databases"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"anonymous callers read instance-wide metadata and load the database","analyst_note":"Confirm whether the route is reachable on default installs and check the vendor advisory on github.com for the how-to-check steps.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Any self-hosted or cloud NocoDB instance running a version before 2026.09.1 that exposes its API to the network is affected. Instances reachable only from a private network with no public exposure carry less risk. The sources do not say whether the flaw depends on any non-default setting.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000702,"input_tokens":4628,"output_tokens":479,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126270':12A,15A '-2026':11A,14A '2026.09.1':24B,64C 'aggreg':27B,72C 'amplifi':117C 'anonym':37B,85C 'attack':88C 'authent':35B,68C 'base':46B,53B,95C,111C 'caller':38B,86C 'contain':65C 'count':9A,44B,97C,104C,106C,113C 'cve':10A,13A 'databas':16B,61B,118C 'endpoint':92C 'enumer':94C 'expos':4A,79C 'host':21B 'info':29B,74C 'instanc':5A,42B,81C 'instance-wid':41B,80C 'live':108C 'load':59B,120C 'meta':28B,73C 'metadata':6A,83C 'miss':67C 'nocodb':1A,17B,22B,62C 'packag':18B 'password':101C 'password-protect':100C 'per':52B,110C 'per-bas':51B,109C 'protect':102C 'queri':119C 'read':40B 'repeat':56B,115C 'request':57B,90C,116C 'rout':3A,30B,75C 'row':8A,54B,112C 'self':20B 'self-host':19B 'share':98C 'skip':34B 'unauthent':2A,87C 'user':47B,96C 'utils.controller.ts':32B,77C 'view':48B,103C 'vulner':69C 'webhook':49B,105C 'wide':43B,82C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted or cloud NocoDB instance running a version before 2026.09.1 that exposes its API to the network is affected. Instances reachable only from a private network with no public exposure carry less risk. The sources do not say whether the flaw depends on any non-default setting.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["databases","medium","nocodb","package","selfhosted"],"campaign_type":null,"search_a":"'-126270':12A,15A '-2026':11A,14A 'count':9A 'cve':10A,13A 'expos':4A 'instanc':5A 'metadata':6A 'nocodb':1A 'rout':3A 'row':8A 'unauthent':2A","search_b":"'2026.09.1':24B 'aggreg':27B 'anonym':37B 'authent':35B 'base':46B,53B 'caller':38B 'count':44B 'databas':16B,61B 'host':21B 'info':29B 'instanc':42B 'instance-wid':41B 'load':59B 'meta':28B 'nocodb':17B,22B 'packag':18B 'per':52B 'per-bas':51B 'read':40B 'repeat':56B 'request':57B 'rout':30B 'row':54B 'self':20B 'self-host':19B 'skip':34B 'user':47B 'utils.controller.ts':32B 'view':48B 'webhook':49B 'wide':43B","search_c":"'2026.09.1':64C 'aggreg':72C 'amplifi':117C 'anonym':85C 'attack':88C 'authent':68C 'base':95C,111C 'caller':86C 'contain':65C 'count':97C,104C,106C,113C 'databas':118C 'endpoint':92C 'enumer':94C 'expos':79C 'info':74C 'instanc':81C 'instance-wid':80C 'live':108C 'load':120C 'meta':73C 'metadata':83C 'miss':67C 'nocodb':62C 'password':101C 'password-protect':100C 'per':110C 'per-bas':109C 'protect':102C 'queri':119C 'repeat':115C 'request':90C,116C 'rout':75C 'row':112C 'share':98C 'unauthent':87C 'user':96C 'utils.controller.ts':77C 'view':103C 'vulner':69C 'webhook':105C 'wide':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126270","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126270","severity":null,"published_at":"2026-11-13T10:17:29+00:00","modified_at":"2026-11-13T10:17:29+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","fetched_at":"2026-11-13T10:47:12+00:00","note":null}],"documents":[{"id":144869,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-5892-3964-gc52","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:16+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144870,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.09.1-unauthenticated-information-disclosure-via-aggregated-meta-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}