{"id":"CVE-2026-126293","kind":"vulnerability","aliases":["CVE-2026-126293"],"related":[],"title":"NocoDB: attachment size limit bypass lets editors fill disk storage","description":"NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understates or omits its length to exhaust disk space or storage quota.","summary":"NocoDB before 2026.06.2 trusts the content length advertised by a remote server when an attachment is uploaded by URL, so the size limit can be skipped. An authenticated Editor can store oversized files and exhaust disk space or storage quota.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NocoDB","fixed":[],"affected":"","ecosystem":"vendor"},{"via":"cpe","name":"nocodb","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm","vendor"],"tags":["nocodb","package","self-hosted","storage"],"not_affected_if":["no-editor-users","version-2026.06.2-or-later"],"how_to_check":"- Check the NocoDB version in use; affected builds are those before `2026.06.2`.\n- Review whether Editor-role users can use the v3 upload-by-URL attachment endpoint.","fix":"- Upgrade NocoDB to `2026.06.2` or later.","status":"open","published_at":"2026-11-13T10:17:33+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","triaged_at":"2026-11-13T10:53:17+00:00","updated_at":"2026-11-13T11:20:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:53:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade NocoDB to `2026.06.2` or later.","reach":"network","title":"NocoDB: attachment size limit bypass lets editors fill disk storage","impact":"medium","summary":"NocoDB before 2026.06.2 trusts the content length advertised by a remote server when an attachment is uploaded by URL, so the size limit can be skipped. An authenticated Editor can store oversized files and exhaust disk space or storage quota.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","storage"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated editor exhausts disk space and storage quota","analyst_note":"","how_to_check":"- Check the NocoDB version in use; affected builds are those before `2026.06.2`.\n- Review whether Editor-role users can use the v3 upload-by-URL attachment endpoint.","plain_action":"","product_name":"NocoDB","needs_analyst":false,"not_affected_if":["version-2026.06.2-or-later","no-editor-users"],"who_is_affected":"Teams that self-host NocoDB before 2026.06.2 and let Editor-role users upload attachments by URL. The flaw is in the v3 upload path that trusts the remote server's advertised length, so instances without that endpoint exposed or with only trusted Editors are less exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000732,"input_tokens":4611,"output_tokens":542,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126293':13A,16A '-2026':12A,15A '2026.06.2':27B,67C 'advertis':32B,90C 'allow':75C 'attach':2A,39B,70C 'attack':93C 'authent':52B,76C 'bypass':5A,73C 'contain':68C 'content':30B,91C 'cve':11A,14A 'data-attachment-v3.service.ts':84C 'disk':9A,60B,114C 'editor':7A,53B,77C 'endpoint':102C 'exhaust':59B,113C 'file':57B,82C 'fill':8A 'host':23B 'length':31B,92C,111C 'let':6A 'limit':4A,47B,72C 'nocodb':1A,17A,18A,19B,25B,65C 'omit':109C 'overs':56B,81C 'packag':20B 'point':95C 'quota':64B,118C 'remot':35B,87C 'self':22B 'self-host':21B 'server':36B,88C,105C 'size':3A,46B,71C 'skip':50B 'space':61B,115C 'storag':10A,24B,63B,117C 'store':55B,80C 'trust':28B,85C 'underst':107C 'upload':41B,99C 'upload-by-url':98C 'url':43B,101C 'user':78C 'v3':97C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host NocoDB before 2026.06.2 and let Editor-role users upload attachments by URL. The flaw is in the v3 upload path that trusts the remote server's advertised length, so instances without that endpoint exposed or with only trusted Editors are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nocodb"],"ptokens":["nocodb"],"labels":["high","nocodb","npm","package","selfhosted","storage","vendor"],"campaign_type":null,"search_a":"'-126293':13A,16A '-2026':12A,15A 'attach':2A 'bypass':5A 'cve':11A,14A 'disk':9A 'editor':7A 'fill':8A 'let':6A 'limit':4A 'nocodb':1A,17A,18A 'size':3A 'storag':10A","search_b":"'2026.06.2':27B 'advertis':32B 'attach':39B 'authent':52B 'content':30B 'disk':60B 'editor':53B 'exhaust':59B 'file':57B 'host':23B 'length':31B 'limit':47B 'nocodb':19B,25B 'overs':56B 'packag':20B 'quota':64B 'remot':35B 'self':22B 'self-host':21B 'server':36B 'size':46B 'skip':50B 'space':61B 'storag':24B,63B 'store':55B 'trust':28B 'upload':41B 'url':43B","search_c":"'2026.06.2':67C 'advertis':90C 'allow':75C 'attach':70C 'attack':93C 'authent':76C 'bypass':73C 'contain':68C 'content':91C 'data-attachment-v3.service.ts':84C 'disk':114C 'editor':77C 'endpoint':102C 'exhaust':113C 'file':82C 'length':92C,111C 'limit':72C 'nocodb':65C 'omit':109C 'overs':81C 'point':95C 'quota':118C 'remot':87C 'server':88C,105C 'size':71C 'space':115C 'storag':117C 'store':80C 'trust':85C 'underst':107C 'upload':99C 'upload-by-url':98C 'url':101C 'user':78C 'v3':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126293","severity":null,"published_at":"2026-11-13T10:17:33+00:00","modified_at":"2026-11-13T10:17:33+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","fetched_at":"2026-11-13T10:47:14+00:00","note":null}],"documents":[{"id":144915,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-cxj6-g54p-jwxp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:54+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144916,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-attachment-size-limit-bypass-via-upload-by-url","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}