{"id":"CVE-2026-126281","kind":"vulnerability","aliases":["CVE-2026-126281"],"related":[],"title":"NocoDB: integration copy leaks other users' private database credentials to Creators","description":"NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own.","summary":"NocoDB before 2026.08.0 does not check ownership or the private flag when creating an integration from an existing one, so the copy step decrypts another user's stored credentials. An authenticated user with the Creator role can read another user's database host, username and password by guessing or enumerating integration ids.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NocoDB","fixed":[],"affected":"","ecosystem":"vendor"},{"via":"cpe","name":"nocodb","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm","vendor"],"tags":["database-credentials","nocodb","package","self-hosted"],"not_affected_if":["single-trusted-user","version-2026.08.0-or-later"],"how_to_check":"- Check the NocoDB version in use; versions before `2026.08.0` are in range.\n- Review which accounts hold the Creator role, since they are the ones who can trigger the copy.\n- Look for integrations marked private that other users could copy.","fix":"- NocoDB: move to `2026.08.0` or later.","status":"open","published_at":"2026-11-13T10:17:31+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","triaged_at":"2026-11-13T10:53:19+00:00","updated_at":"2026-11-13T11:20:09+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:53:19Z","model":"claude-haiku-5-5","output":{"fix":"- NocoDB: move to `2026.08.0` or later.","reach":"network","title":"NocoDB: integration copy leaks other users' private database credentials to Creators","impact":"high","summary":"NocoDB before 2026.08.0 does not check ownership or the private flag when creating an integration from an existing one, so the copy step decrypts another user's stored credentials. An authenticated user with the Creator role can read another user's database host, username and password by guessing or enumerating integration ids.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","database-credentials"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Other users' database passwords are copied and readable by the attacker.","analyst_note":"","how_to_check":"- Check the NocoDB version in use; versions before `2026.08.0` are in range.\n- Review which accounts hold the Creator role, since they are the ones who can trigger the copy.\n- Look for integrations marked private that other users could copy.","plain_action":"","product_name":"NocoDB","needs_analyst":false,"not_affected_if":["version-2026.08.0-or-later","single-trusted-user"],"who_is_affected":"Self-hosted or cloud NocoDB deployments before 2026.08.0 where users hold the Creator role and share a workspace with integrations containing database credentials. Instances where only trusted users can create integrations have much less exposure.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000738,"input_tokens":4616,"output_tokens":553,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126281':14A,17A '-2026':13A,16A '2026.08.0':30B,82C 'anoth':52B,66B 'authent':58B,114C 'author':86C 'branch':93C 'check':33B,108C 'connect':105C 'contain':83C 'copi':3A,49B,91C,128C 'copy-from':90C 'creat':40B 'creation':96C 'creator':11A,62B,118C 'credenti':9A,22B,56B,106C 'cve':12A,15A 'databas':8A,21B,69B,132C 'database-credenti':20B 'decrypt':51B,100C 'enumer':77B,124C 'exist':45B 'flag':38B,113C 'guess':75B,122C 'host':27B,70B,133C 'id':79B,126C 'integr':2A,42B,78B,95C,103C,125C,139C 'integrations.service.ts':98C 'leak':4A 'miss':85C 'nocodb':1A,18A,19A,23B,28B,80C 'one':46B 'owner':110C 'ownership':34B 'packag':24B 'password':73B,136C 'privat':7A,37B,112C,131C 'read':65B 'role':63B,119C 'self':26B 'self-host':25B 'sourc':102C 'step':50B 'store':55B 'suppli':121C 'user':6A,53B,59B,67B,115C,130C 'usernam':71B,134C 'vulner':87C 'without':107C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or cloud NocoDB deployments before 2026.08.0 where users hold the Creator role and share a workspace with integrations containing database credentials. Instances where only trusted users can create integrations have much less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nocodb"],"ptokens":["nocodb"],"labels":["databasecredentials","high","nocodb","npm","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126281':14A,17A '-2026':13A,16A 'copi':3A 'creator':11A 'credenti':9A 'cve':12A,15A 'databas':8A 'integr':2A 'leak':4A 'nocodb':1A,18A,19A 'privat':7A 'user':6A","search_b":"'2026.08.0':30B 'anoth':52B,66B 'authent':58B 'check':33B 'copi':49B 'creat':40B 'creator':62B 'credenti':22B,56B 'databas':21B,69B 'database-credenti':20B 'decrypt':51B 'enumer':77B 'exist':45B 'flag':38B 'guess':75B 'host':27B,70B 'id':79B 'integr':42B,78B 'nocodb':23B,28B 'one':46B 'ownership':34B 'packag':24B 'password':73B 'privat':37B 'read':65B 'role':63B 'self':26B 'self-host':25B 'step':50B 'store':55B 'user':53B,59B,67B 'usernam':71B","search_c":"'2026.08.0':82C 'authent':114C 'author':86C 'branch':93C 'check':108C 'connect':105C 'contain':83C 'copi':91C,128C 'copy-from':90C 'creation':96C 'creator':118C 'credenti':106C 'databas':132C 'decrypt':100C 'enumer':124C 'flag':113C 'guess':122C 'host':133C 'id':126C 'integr':95C,103C,125C,139C 'integrations.service.ts':98C 'miss':85C 'nocodb':80C 'owner':110C 'password':136C 'privat':112C,131C 'role':119C 'sourc':102C 'suppli':121C 'user':115C,130C 'usernam':134C 'vulner':87C 'without':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126281","severity":null,"published_at":"2026-11-13T10:17:31+00:00","modified_at":"2026-11-13T10:17:31+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","fetched_at":"2026-11-13T10:47:13+00:00","note":null}],"documents":[{"id":144891,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-355h-p2mj-vwc9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144892,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-private-integration-credential-exposure-via-copy","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}