---
id: "CVE-2026-126292"
page: "https://infrastack.ai/live/CVE-2026-126292"
kind: "vulnerability"
aliases: ["CVE-2026-126292"]
title: "NocoDB: profile update leaks password hash and session data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["nocodb", "package", "self-hosted"]
not_affected_if: ["version-2026.06.1-or-later"]
published_at: "2026-11-13T10:17:33+00:00"
first_seen_at: "2026-11-13T10:47:14+00:00"
updated_at: "2026-11-13T10:58:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126292", "first_seen_at": "2026-11-13T10:47:14+00:00"}]
exploit_sources: []
---

# NocoDB: profile update leaks password hash and session data

Link for people: https://infrastack.ai/live/CVE-2026-126292 (this .md is for agents)

NocoDB's profile update handler returns the stored user record without filtering it, so the bcrypt password hash, salt and session token counter come back in the response. An attacker holding a stolen or hijacked session can read these values and attempt offline password cracking.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the NocoDB version in use; versions before `2026.06.1` are affected.
- Review the deployment for whether users can reach the profile update endpoint with a valid session.

## Fix

- NocoDB: upgrade to `2026.06.1` or later.

## Timeline

- 2026-11-13T10:47:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126292

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nocodb/nocodb/security/advisories/GHSA-q5wf-7cr7-72h3
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nocodb-before-2026.06.1-password-hash-exposure-via-profile-update-response

## From the sources

NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_