CVE-2026-126282 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
NocoDB, an open-source no-code database tool, lets a user whose legacy organization role is updated get that role written into their default workspace. A revoked user keeps their existing session token and can silently regain Creator-level read, write and schema access to bases in the default workspace.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted or cloud NocoDB instances on releases from 2026.04.0 before 2026.08.0 that use organization roles and default workspaces. Exposure depends on whether users are revoked or have their organization role changed while they still hold sessions. Instances on 2026.08.0 or later are not affected.
Not affected if version-2026.08.0-or-later
Who cares nocodb, saas-admin, self-hosted
2026.04.0 before 2026.08.02026.08.0 or laterNocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read, write and schema modification access across all default-workspace bases using their existing session token.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.