{"id":"CVE-2026-126290","kind":"vulnerability","aliases":["CVE-2026-126290"],"related":[],"title":"NocoDB: authenticated base members can read other users' integration credentials","description":"NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials.","summary":"NocoDB before 2026.07.0 has a flaw in its base integrations service that skips an ownership check when a query flag is left out. An attacker with a base membership can read another user's private integration configuration, including stored connection credentials.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","nocodb","self-hosted"],"not_affected_if":["no-shared-bases","nocodb-2026.07.0-or-later"],"how_to_check":"- Check the installed NocoDB version; `unknown` if the sources give no command.\n- Look for private integrations stored in NocoDB bases that other members should not see.","fix":"- NocoDB: move to `2026.07.0` or later.","status":"open","published_at":"2026-11-13T10:17:33+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","triaged_at":"2026-11-13T10:53:19+00:00","updated_at":"2026-11-13T10:53:19+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-13T10:53:19Z","model":"claude-haiku-5-5","output":{"fix":"- NocoDB: move to `2026.07.0` or later.","reach":"network","title":"NocoDB: authenticated base members can read other users' integration credentials","impact":"high","summary":"NocoDB before 2026.07.0 has a flaw in its base integrations service that skips an ownership check when a query flag is left out. An attacker with a base membership can read another user's private integration configuration, including stored connection credentials.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["nocodb","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"stored connection credentials for other users' integrations readable","analyst_note":"Confirm the affected version range and whether the flaw depends on configuration, using the NVD entry and the vendor advisory linked from the GitHub advisory.","how_to_check":"- Check the installed NocoDB version; `unknown` if the sources give no command.\n- Look for private integrations stored in NocoDB bases that other members should not see.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["nocodb-2026.07.0-or-later","no-shared-bases"],"who_is_affected":"Teams that self-host NocoDB before 2026.07.0 and let multiple users share bases with private integrations configured. Exposure needs an account that is a member of the base; the sources do not say whether the flaw applies to every deployment or only some configurations.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000728,"input_tokens":4601,"output_tokens":535,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126290':13A,16A '-2026':12A,15A '2026.07.0':26B,67C 'ai':18B 'ai-tool':17B 'allow':76C 'anoth':55B,93C 'attack':48B,90C 'authent':2A,77C 'base':3A,32B,51B,78C 'base-integrations.service.ts':74C 'bypass':102C 'check':39B,105C 'configur':60B,84C,100C 'connect':63B,109C 'contain':68C 'credenti':10A,64B,110C 'cve':11A,14A 'disclosur':71C 'flag':43B,89C,101C 'flaw':29B 'host':23B 'includ':61B 'inform':70C 'integr':9A,33B,59B,83C,97C 'left':45B 'member':4A,79C 'membership':52B 'nocodb':1A,20B,24B,65C 'obtain':107C 'omit':86C 'ownership':38B,104C 'privat':58B,82C,96C 'queri':42B,88C 'read':6A,54B,81C 'request':92C 'self':22B 'self-host':21B 'servic':34B 'skip':36B 'store':62B,108C 'tool':19B 'user':8A,56B,94C 'vulner':72C 'without':98C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host NocoDB before 2026.07.0 and let multiple users share bases with private integrations configured. Exposure needs an account that is a member of the base; the sources do not say whether the flaw applies to every deployment or only some configurations.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","nocodb","selfhosted"],"campaign_type":null,"search_a":"'-126290':13A,16A '-2026':12A,15A 'authent':2A 'base':3A 'credenti':10A 'cve':11A,14A 'integr':9A 'member':4A 'nocodb':1A 'read':6A 'user':8A","search_b":"'2026.07.0':26B 'ai':18B 'ai-tool':17B 'anoth':55B 'attack':48B 'base':32B,51B 'check':39B 'configur':60B 'connect':63B 'credenti':64B 'flag':43B 'flaw':29B 'host':23B 'includ':61B 'integr':33B,59B 'left':45B 'membership':52B 'nocodb':20B,24B 'ownership':38B 'privat':58B 'queri':42B 'read':54B 'self':22B 'self-host':21B 'servic':34B 'skip':36B 'store':62B 'tool':19B 'user':56B","search_c":"'2026.07.0':67C 'allow':76C 'anoth':93C 'attack':90C 'authent':77C 'base':78C 'base-integrations.service.ts':74C 'bypass':102C 'check':105C 'configur':84C,100C 'connect':109C 'contain':68C 'credenti':110C 'disclosur':71C 'flag':89C,101C 'inform':70C 'integr':83C,97C 'member':79C 'nocodb':65C 'obtain':107C 'omit':86C 'ownership':104C 'privat':82C,96C 'queri':88C 'read':81C 'request':92C 'store':108C 'user':94C 'vulner':72C 'without':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126290","severity":null,"published_at":"2026-11-13T10:17:33+00:00","modified_at":"2026-11-13T10:17:33+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","fetched_at":"2026-11-13T10:47:14+00:00","note":null}],"documents":[{"id":144909,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-wxxj-mghf-33v4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144910,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.07.0-private-integration-credential-exposure-via-base-integration-read","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}