CVE-2026-126291 · Other
NO FIX YET · SEE WHAT TO DO
NocoDB builds SQL queries by concatenating base members' email addresses into the query text, so an email with a quoted local part containing a single quote breaks out of the string. A registered user who sets such an email can run arbitrary SQL and read user records, API tokens and data-source credentials.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any self-hosted or managed NocoDB instance before 2026.06.2 where registered users can set an email address on a base. The flaw sits in the code that resolves user, created-by and last-modified-by fields, so instances with only trusted, invited members are still reachable by those members. Instances on a vendor-run cloud service are handled by the vendor's upgrade, but the team should confirm the running version.
Not affected if managed-hosting, no-self-registration
Who cares mysql, nocodb, postgres, self-hosted
2026.06.2.2026.06.2 or later.NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a single quote to execute arbitrary SQL, exposing user records, API tokens and data-source credentials.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.