{"id":"CVE-2026-126280","kind":"vulnerability","aliases":["CVE-2026-126280"],"related":[],"title":"NocoDB: refresh-token race lets captured tokens mint sessions","description":"NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded.","summary":"NocoDB before 2026.08.0 has a race condition in refresh-token rotation, because the code never checks how many rows an update touched. An attacker holding a captured refresh token can present it concurrently with the legitimate user and obtain a valid authenticated session, with no reuse event recorded.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nocodb","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["auth","nocodb","package","self-hosted"],"not_affected_if":["version-2026.08.0-or-later"],"how_to_check":"- Check the running NocoDB version, for example in the admin panel or the image tag, and compare it with `2026.08.0`.","fix":"- NocoDB: move to `2026.08.0` or later.","status":"open","published_at":"2026-11-13T10:17:31+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","triaged_at":"2026-11-13T10:48:41+00:00","updated_at":"2026-11-13T10:48:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:48:41Z","model":"claude-haiku-5-5","output":{"fix":"- NocoDB: move to `2026.08.0` or later.","reach":"internet","title":"NocoDB: refresh-token race lets captured tokens mint sessions","impact":"high","summary":"NocoDB before 2026.08.0 has a race condition in refresh-token rotation, because the code never checks how many rows an update touched. An attacker holding a captured refresh token can present it concurrently with the legitimate user and obtain a valid authenticated session, with no reuse event recorded.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","auth"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker gets an authenticated session from a stolen refresh token","analyst_note":"Confirm the exact affected range and how refresh tokens are exposed, using the vendor advisory on github.com and the vulncheck advisory.","how_to_check":"- Check the running NocoDB version, for example in the admin panel or the image tag, and compare it with `2026.08.0`.\n- Unknown whether a source gives a specific config flag or log to inspect.","plain_action":"","product_name":"nocodb","needs_analyst":true,"not_affected_if":["version-2026.08.0-or-later"],"who_is_affected":"Self-hosted or managed NocoDB instances before 2026.08.0 that issue refresh tokens to users. Attackers need a captured refresh token, so exposure depends on how tokens are stored and transmitted. Teams on managed hosting or on versions at or after 2026.08.0 can skip it.","user_interaction":"no","product_ecosystem":"npm","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4613,"output_tokens":598,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126280':13A,16A '-2026':12A,15A '2026.08.0':26B,75C 'affect':97C 'affected-row':96C 'allow':86C 'attack':48B,87C,100C 'auth':18B 'authent':66B,118C 'captur':7A,51B,103C 'check':40B,94C 'code':38B 'concurr':57B,109C 'condit':30B,79C 'contain':76C 'count':99C 'cve':11A,14A 'event':71B,123C 'hold':49B,101C 'host':23B 'legitim':60B,112C 'let':6A 'mani':42B 'mint':9A 'never':39B,93C 'nocodb':1A,17A,19B,24B,73C 'obtain':63B,115C 'packag':20B 'present':55B,107C 'race':5A,29B,78C 'record':72B,125C 'refresh':3A,33B,52B,82C,104C 'refresh-token':2A,32B,81C 'reus':70B,89C,122C 'rotat':35B,84C 'row':43B,98C 'self':22B 'self-host':21B 'session':10A,67B,119C 'token':4A,8A,34B,53B,83C,90C,105C 'touch':46B 'updat':45B 'user':61B,113C 'userrefreshtoken.ts':92C 'valid':65B,117C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed NocoDB instances before 2026.08.0 that issue refresh tokens to users. Attackers need a captured refresh token, so exposure depends on how tokens are stored and transmitted. Teams on managed hosting or on versions at or after 2026.08.0 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nocodb"],"ptokens":["nocodb"],"labels":["auth","critical","nocodb","npm","package","selfhosted"],"campaign_type":null,"search_a":"'-126280':13A,16A '-2026':12A,15A 'captur':7A 'cve':11A,14A 'let':6A 'mint':9A 'nocodb':1A,17A 'race':5A 'refresh':3A 'refresh-token':2A 'session':10A 'token':4A,8A","search_b":"'2026.08.0':26B 'attack':48B 'auth':18B 'authent':66B 'captur':51B 'check':40B 'code':38B 'concurr':57B 'condit':30B 'event':71B 'hold':49B 'host':23B 'legitim':60B 'mani':42B 'never':39B 'nocodb':19B,24B 'obtain':63B 'packag':20B 'present':55B 'race':29B 'record':72B 'refresh':33B,52B 'refresh-token':32B 'reus':70B 'rotat':35B 'row':43B 'self':22B 'self-host':21B 'session':67B 'token':34B,53B 'touch':46B 'updat':45B 'user':61B 'valid':65B","search_c":"'2026.08.0':75C 'affect':97C 'affected-row':96C 'allow':86C 'attack':87C,100C 'authent':118C 'captur':103C 'check':94C 'concurr':109C 'condit':79C 'contain':76C 'count':99C 'event':123C 'hold':101C 'legitim':112C 'never':93C 'nocodb':73C 'obtain':115C 'present':107C 'race':78C 'record':125C 'refresh':82C,104C 'refresh-token':81C 'reus':89C,122C 'rotat':84C 'row':98C 'session':119C 'token':83C,90C,105C 'user':113C 'userrefreshtoken.ts':92C 'valid':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:05:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126280","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126280","severity":null,"published_at":"2026-11-13T10:17:31+00:00","modified_at":"2026-11-13T10:17:31+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","fetched_at":"2026-11-13T10:47:13+00:00","note":null}],"documents":[{"id":144889,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-mh65-9xcf-vf8v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:05:28+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144890,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-refresh-token-reuse-via-non-atomic-rotation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}