{"id":"CVE-2026-126292","kind":"vulnerability","aliases":["CVE-2026-126292"],"related":[],"title":"NocoDB: profile update leaks password hash and session data","description":"NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking.","summary":"NocoDB's profile update handler returns the stored user record without filtering it, so the bcrypt password hash, salt and session token counter come back in the response. An attacker holding a stolen or hijacked session can read these values and attempt offline password cracking.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nocodb","package","self-hosted"],"not_affected_if":["version-2026.06.1-or-later"],"how_to_check":"- Check the NocoDB version in use; versions before `2026.06.1` are affected.\n- Review the deployment for whether users can reach the profile update endpoint with a valid session.","fix":"- NocoDB: upgrade to `2026.06.1` or later.","status":"open","published_at":"2026-11-13T10:17:33+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","triaged_at":"2026-11-13T10:58:36+00:00","updated_at":"2026-11-13T10:58:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:58:36Z","model":"claude-haiku-5-5","output":{"fix":"- NocoDB: upgrade to `2026.06.1` or later.","reach":"internet","title":"NocoDB: profile update leaks password hash and session data","impact":"medium","summary":"NocoDB's profile update handler returns the stored user record without filtering it, so the bcrypt password hash, salt and session token counter come back in the response. An attacker holding a stolen or hijacked session can read these values and attempt offline password cracking.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Password hashes and salts readable, enabling offline cracking of account passwords.","analyst_note":"","how_to_check":"- Check the NocoDB version in use; versions before `2026.06.1` are affected.\n- Review the deployment for whether users can reach the profile update endpoint with a valid session.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2026.06.1-or-later"],"who_is_affected":"Teams running a self-hosted or cloud NocoDB instance on a version before `2026.06.1` are exposed, because any logged-in user's profile update response includes their own password hash and salt. An attacker needs an already stolen or hijacked session, so instances without shared or exposed sessions carry less practical risk. unknown for other deployment details.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":4619,"output_tokens":534,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126292':12A,15A '-2026':11A,14A '2026.06.1':68C 'account':120C 'attack':50B,106C 'attempt':62B 'back':45B 'bcrypt':36B,98C 'come':44B 'contain':69C 'counter':43B,105C 'crack':65B,128C 'cve':10A,13A 'data':9A 'disclosur':72C 'expos':96C 'filter':32B,95C 'handler':25B,78C 'hash':6A,38B,100C,123C 'hijack':55B,111C 'hold':51B,107C 'host':20B 'inform':71C 'leak':4A 'nocodb':1A,16B,21B,66C 'offlin':63B,127C 'packag':17B 'pass':88C 'password':5A,37B,64B,99C,122C 'profil':2A,23B,76C,116C 'read':58B 'record':30B,86C 'respons':48B 'retriev':118C 'return':26B,82C 'salt':39B,101C,125C 'self':19B 'self-host':18B 'serial':94C 'session':8A,41B,56B,103C,112C 'stolen':53B,109C 'store':28B,84C 'token':42B,104C 'updat':3A,24B,77C,114C 'user':29B,85C,93C 'user-seri':92C 'users.service.ts':80C 'valu':60B 'vulner':73C 'without':31B,87C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted or cloud NocoDB instance on a version before `2026.06.1` are exposed, because any logged-in user's profile update response includes their own password hash and salt. An attacker needs an already stolen or hijacked session, so instances without shared or exposed sessions carry less practical risk. unknown for other deployment details.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","nocodb","package","selfhosted"],"campaign_type":null,"search_a":"'-126292':12A,15A '-2026':11A,14A 'cve':10A,13A 'data':9A 'hash':6A 'leak':4A 'nocodb':1A 'password':5A 'profil':2A 'session':8A 'updat':3A","search_b":"'attack':50B 'attempt':62B 'back':45B 'bcrypt':36B 'come':44B 'counter':43B 'crack':65B 'filter':32B 'handler':25B 'hash':38B 'hijack':55B 'hold':51B 'host':20B 'nocodb':16B,21B 'offlin':63B 'packag':17B 'password':37B,64B 'profil':23B 'read':58B 'record':30B 'respons':48B 'return':26B 'salt':39B 'self':19B 'self-host':18B 'session':41B,56B 'stolen':53B 'store':28B 'token':42B 'updat':24B 'user':29B 'valu':60B 'without':31B","search_c":"'2026.06.1':68C 'account':120C 'attack':106C 'bcrypt':98C 'contain':69C 'counter':105C 'crack':128C 'disclosur':72C 'expos':96C 'filter':95C 'handler':78C 'hash':100C,123C 'hijack':111C 'hold':107C 'inform':71C 'nocodb':66C 'offlin':127C 'pass':88C 'password':99C,122C 'profil':76C,116C 'record':86C 'retriev':118C 'return':82C 'salt':101C,125C 'serial':94C 'session':103C,112C 'stolen':109C 'store':84C 'token':104C 'updat':77C,114C 'user':85C,93C 'user-seri':92C 'users.service.ts':80C 'vulner':73C 'without':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126292","severity":null,"published_at":"2026-11-13T10:17:33+00:00","modified_at":"2026-11-13T10:17:33+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","fetched_at":"2026-11-13T10:47:14+00:00","note":null}],"documents":[{"id":144913,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-q5wf-7cr7-72h3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:28+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144914,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.06.1-password-hash-exposure-via-profile-update-response","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}