CVE-2026-126275 · Package
NO FIX YET · SEE WHAT TO DO
NocoDB, a self-hosted spreadsheet-style database, lets an authenticated user read row comments and author emails from bases they have no access to by supplying only model and row ids. An attacker with a Viewer or Creator role on any base can also plant decoy tables to spoof teammates' comments.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any NocoDB instance before 2026.09.0 where users have accounts on the same server. Exposure depends on how many people hold a login and whether bases contain sensitive comments. Single-user or fully trusted deployments carry much less risk.
Not affected if single-user, version-2026.09.0-or-later
Who cares nocodb, self-hosted
nocodb --version or the image tag) and compare it with the fixed version.2026.09.0 or later.NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.