{"id":"CVE-2026-126282","kind":"vulnerability","aliases":["CVE-2026-126282"],"related":[],"title":"NocoDB: revoked users regain workspace write access with existing session","description":"NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read, write and schema modification access across all default-workspace bases using their existing session token.","summary":"NocoDB, an open-source no-code database tool, lets a user whose legacy organization role is updated get that role written into their default workspace. A revoked user keeps their existing session token and can silently regain Creator-level read, write and schema access to bases in the default workspace.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","nocodb","saas-admin","self-hosted"],"not_affected_if":["version-2026.08.0-or-later"],"how_to_check":"- Check the installed NocoDB version; affected releases are from `2026.04.0` before `2026.08.0`","fix":"- Move to `2026.08.0` or later","status":"open","published_at":"2026-11-13T10:17:31+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","triaged_at":"2026-11-13T10:50:54+00:00","updated_at":"2026-11-13T10:50:54+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-13T10:50:54Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `2026.08.0` or later\n- unknown for any other setting","reach":"internet","title":"NocoDB: revoked users regain workspace write access with existing session","impact":"high","summary":"NocoDB, an open-source no-code database tool, lets a user whose legacy organization role is updated get that role written into their default workspace. A revoked user keeps their existing session token and can silently regain Creator-level read, write and schema access to bases in the default workspace.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["nocodb","self-hosted","saas-admin"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"revoked user gains creator access to workspace bases","analyst_note":"","how_to_check":"- Check the installed NocoDB version; affected releases are from `2026.04.0` before `2026.08.0`\n- unknown for other checks, the sources do not say","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2026.08.0-or-later"],"who_is_affected":"Self-hosted or cloud NocoDB instances on releases from 2026.04.0 before 2026.08.0 that use organization roles and default workspaces. Exposure depends on whether users are revoked or have their organization role changed while they still hold sessions. Instances on 2026.08.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4603,"output_tokens":512,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126282':13A,16A '-2026':12A,15A '2026.04.0':82C '2026.08.0':84C 'access':7A,73B,120C 'across':121C 'admin':23B 'ai':18B 'ai-tool':17B 'base':75B,126C 'code':34B 'contain':85C 'creator':67B,113C 'creator-level':66B,112C 'cve':11A,14A 'databas':35B 'default':52B,78B,104C,124C 'default-workspac':103C,123C 'exist':9A,59B,129C 'get':46B 'host':26B 'improp':87C 'keep':57B 'legaci':41B,98C 'let':37B 'level':68B,114C 'manag':89C 'modif':119C 'no-cod':32B 'nocodb':1A,20B,27B,80C 'open':30B 'open-sourc':29B 'org-users.service.ts':92C 'organ':42B,99C 'privileg':88C 'read':69B,115C 'regain':4A,65B,111C 'revok':2A,55B,107C 'rewrit':101C 'role':43B,48B,100C,106C 'saa':22B 'saas-admin':21B 'schema':72B,118C 'self':25B 'self-host':24B 'session':10A,60B,130C 'silent':64B,110C 'sourc':31B 'token':61B,131C 'tool':19B,36B 'updat':45B,94C 'use':127C 'user':3A,39B,56B,96C,108C 'vulner':90C 'whose':40B 'workspac':5A,53B,79B,105C,125C 'write':6A,70B,116C 'written':49B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or cloud NocoDB instances on releases from 2026.04.0 before 2026.08.0 that use organization roles and default workspaces. Exposure depends on whether users are revoked or have their organization role changed while they still hold sessions. Instances on 2026.08.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","nocodb","saasadmin","selfhosted"],"campaign_type":null,"search_a":"'-126282':13A,16A '-2026':12A,15A 'access':7A 'cve':11A,14A 'exist':9A 'nocodb':1A 'regain':4A 'revok':2A 'session':10A 'user':3A 'workspac':5A 'write':6A","search_b":"'access':73B 'admin':23B 'ai':18B 'ai-tool':17B 'base':75B 'code':34B 'creator':67B 'creator-level':66B 'databas':35B 'default':52B,78B 'exist':59B 'get':46B 'host':26B 'keep':57B 'legaci':41B 'let':37B 'level':68B 'no-cod':32B 'nocodb':20B,27B 'open':30B 'open-sourc':29B 'organ':42B 'read':69B 'regain':65B 'revok':55B 'role':43B,48B 'saa':22B 'saas-admin':21B 'schema':72B 'self':25B 'self-host':24B 'session':60B 'silent':64B 'sourc':31B 'token':61B 'tool':19B,36B 'updat':45B 'user':39B,56B 'whose':40B 'workspac':53B,79B 'write':70B 'written':49B","search_c":"'2026.04.0':82C '2026.08.0':84C 'access':120C 'across':121C 'base':126C 'contain':85C 'creator':113C 'creator-level':112C 'default':104C,124C 'default-workspac':103C,123C 'exist':129C 'improp':87C 'legaci':98C 'level':114C 'manag':89C 'modif':119C 'nocodb':80C 'org-users.service.ts':92C 'organ':99C 'privileg':88C 'read':115C 'regain':111C 'revok':107C 'rewrit':101C 'role':100C,106C 'schema':118C 'session':130C 'silent':110C 'token':131C 'updat':94C 'use':127C 'user':96C,108C 'vulner':90C 'workspac':105C,125C 'write':116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126282","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126282","severity":null,"published_at":"2026-11-13T10:17:31+00:00","modified_at":"2026-11-13T10:17:31+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","fetched_at":"2026-11-13T10:47:13+00:00","note":null}],"documents":[{"id":144893,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-jj94-6wwc-qhcx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144894,"url":"https://www.vulncheck.com/advisories/nocodb-from-2026.04.0-before-2026.08.0-improper-privilege-management-via-organization-role-update","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}