{"id":"CVE-2026-126278","kind":"vulnerability","aliases":["CVE-2026-126278"],"related":[],"title":"NocoDB: race in password reset lets a token holder lock out owners","description":"NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out.","summary":"NocoDB before 2026.08.1 has a race condition in its password reset code, so someone holding a valid reset token can send concurrent requests and set the password several times. The window opens during slow bcrypt hashing before the token is cleared, letting an attacker overwrite the owner's new password and lock them out.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NocoDB","fixed":[],"affected":"","ecosystem":"vendor"},{"via":"cpe","name":"nocodb","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm","vendor"],"tags":["nocodb","package","password-reset","self-hosted"],"not_affected_if":["managed-hosting","reset-disabled"],"how_to_check":"- Check the running NocoDB version against `2026.08.1`; anything lower is in range.\n- Review whether password reset is enabled for your instance (unknown from sources whether it is on by default).","fix":"- NocoDB: move to `2026.08.1` or later.","status":"open","published_at":"2026-11-13T10:17:31+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","triaged_at":"2026-11-13T10:50:32+00:00","updated_at":"2026-11-13T11:20:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:50:32Z","model":"claude-haiku-5-5","output":{"fix":"- NocoDB: move to `2026.08.1` or later.","reach":"internet","title":"NocoDB: race in password reset lets a token holder lock out owners","impact":"high","summary":"NocoDB before 2026.08.1 has a race condition in its password reset code, so someone holding a valid reset token can send concurrent requests and set the password several times. The window opens during slow bcrypt hashing before the token is cleared, letting an attacker overwrite the owner's new password and lock them out.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","password-reset"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker takes over a user's account by overwriting the password","analyst_note":"","how_to_check":"- Check the running NocoDB version against `2026.08.1`; anything lower is in range.\n- Review whether password reset is enabled for your instance (unknown from sources whether it is on by default).","plain_action":"","product_name":"NocoDB","needs_analyst":false,"not_affected_if":["managed-hosting","reset-disabled"],"who_is_affected":"Teams that self-host NocoDB before 2026.08.1 and allow password reset. Exploitation requires a valid reset token, so instances with no reset flow in use face less exposure. Hosted or managed NocoDB is handled by the vendor.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4607,"output_tokens":532,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126278':15A,18A '-2026':14A,17A '2026.08.1':31B,83C 'allow':92C 'attack':72B,109C 'bcrypt':63B,117C 'chang':103C 'clear':69B,123C 'code':40B 'concurr':50B,106C 'condit':35B,87C 'contain':84C 'creat':114C 'cve':13A,16A 'exploit':111C 'hash':64B,118C 'hold':43B 'holder':9A,93C 'host':28B 'let':6A,70B 'lock':10A,80B,132C 'multipl':101C 'new':77B,129C 'nocodb':1A,19A,20A,21B,29B,81C 'open':60B 'overwrit':73B,125C 'owner':12A,75B,127C 'packag':22B 'password':4A,24B,38B,55B,78B,102C,130C 'password-reset':23B 'perform':100C 'race':2A,34B,86C 'request':51B,108C 'reset':5A,25B,39B,46B,97C,107C 'self':27B 'self-host':26B 'send':49B,105C 'set':53B 'sever':56B 'slow':62B,116C 'someon':42B 'time':57B 'token':8A,47B,67B,98C,121C 'users.service.ts':90C 'valid':45B,96C 'vulner':88C 'window':59B,113C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host NocoDB before 2026.08.1 and allow password reset. Exploitation requires a valid reset token, so instances with no reset flow in use face less exposure. Hosted or managed NocoDB is handled by the vendor.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nocodb"],"ptokens":["nocodb"],"labels":["high","nocodb","npm","package","passwordreset","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126278':15A,18A '-2026':14A,17A 'cve':13A,16A 'holder':9A 'let':6A 'lock':10A 'nocodb':1A,19A,20A 'owner':12A 'password':4A 'race':2A 'reset':5A 'token':8A","search_b":"'2026.08.1':31B 'attack':72B 'bcrypt':63B 'clear':69B 'code':40B 'concurr':50B 'condit':35B 'hash':64B 'hold':43B 'host':28B 'let':70B 'lock':80B 'new':77B 'nocodb':21B,29B 'open':60B 'overwrit':73B 'owner':75B 'packag':22B 'password':24B,38B,55B,78B 'password-reset':23B 'race':34B 'request':51B 'reset':25B,39B,46B 'self':27B 'self-host':26B 'send':49B 'set':53B 'sever':56B 'slow':62B 'someon':42B 'time':57B 'token':47B,67B 'valid':45B 'window':59B","search_c":"'2026.08.1':83C 'allow':92C 'attack':109C 'bcrypt':117C 'chang':103C 'clear':123C 'concurr':106C 'condit':87C 'contain':84C 'creat':114C 'exploit':111C 'hash':118C 'holder':93C 'lock':132C 'multipl':101C 'new':129C 'nocodb':81C 'overwrit':125C 'owner':127C 'password':102C,130C 'perform':100C 'race':86C 'request':108C 'reset':97C,107C 'send':105C 'slow':116C 'token':98C,121C 'users.service.ts':90C 'valid':96C 'vulner':88C 'window':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126278","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126278","severity":null,"published_at":"2026-11-13T10:17:31+00:00","modified_at":"2026-11-13T10:17:31+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","fetched_at":"2026-11-13T10:47:13+00:00","note":null}],"documents":[{"id":144885,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-7mf9-q77p-r4r3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:23+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144886,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-password-reset-token-race-condition","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}