{"id":"CVE-2026-28361","kind":"vulnerability","aliases":["CVE-2026-28361","GHSA-p9x3-w98f-7j3q"],"related":[],"title":"NocoDB Missing Ownership Validation in MCP Token Operations","description":"### Summary\nThe MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known.\n\n### Details\n`McpTokenService.get()`, `regenerateToken()`, and `delete()` did not filter by `fk_user_id`. The analogous `ApiTokensService` correctly enforced ownership.\n\n### Impact\nLimited — requires Creator role and knowledge of target token ID. Primary risk is denial of service (invalidating tokens) and scoped token disclosure.\n\n### Credit\nThis issue was reported by [@bugbunny-research](https://github.com/bugbunny-research) (bugbunny.ai).","summary":"NocoDB's MCP token service does not check who owns a token before reading, regenerating or deleting it. A user with the Creator role in the same base can act on another user's MCP token if they know its ID, which can disable tokens or expose a scoped token.","severity":"medium","cvss":null,"epss":0.00185,"exploited":false,"exploited_at":null,"products":[{"name":"nocodb","fixed":["0.301.3"],"affected":"<= 0.301.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-639","mcp","nocodb","package","self-hosted"],"not_affected_if":["managed-hosting","mcp-unused"],"how_to_check":"- Check the installed version of the npm package `nocodb` (for example `npm ls nocodb`) and compare it to `0.301.3`.\n- If you run NocoDB from a container, check the image tag against the release that includes `0.301.3`.","fix":"- `nocodb` (npm): move to `0.301.3` or later.","status":"open","published_at":"2026-03-02T19:53:41+00:00","first_seen_at":"2026-11-05T22:46:57+00:00","triaged_at":"2026-11-05T22:48:40+00:00","updated_at":"2026-11-05T22:48:40+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T22:48:40Z","model":"claude-haiku-5-5","output":{"fix":"- `nocodb` (npm): move to `0.301.3` or later.","reach":"network","title":"NocoDB: MCP token service lets Creators read or delete other users' tokens","impact":"medium","summary":"NocoDB's MCP token service does not check who owns a token before reading, regenerating or deleting it. A user with the Creator role in the same base can act on another user's MCP token if they know its ID, which can disable tokens or expose a scoped token.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","mcp"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Another base user reads, regenerates or deletes MCP tokens.","analyst_note":"","how_to_check":"- Check the installed version of the npm package `nocodb` (for example `npm ls nocodb`) and compare it to `0.301.3`.\n- If you run NocoDB from a container, check the image tag against the release that includes `0.301.3`.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","mcp-unused"],"who_is_affected":"Teams that self-host NocoDB with MCP tokens enabled and give users the Creator role in a shared base. The flaw needs an account with Creator access and the target token's ID, so instances where everyone is an admin or MCP is unused carry less practical risk. Teams on hosted NocoDB Cloud are handled by the vendor.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000718,"input_tokens":4457,"output_tokens":545,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,18A '-28361':11A,19A '-639':22B '/bugbunny-research)':164C '7j3q':16A 'act':58B 'allow':89C 'analog':125C 'anoth':60B,101C 'apitokensservic':126C 'base':56B,95C 'bugbunni':160C 'bugbunny-research':159C 'bugbunny.ai':165C 'check':36B 'correct':127C 'creator':51B,91C,133C 'credit':153C 'cve':9A,17A 'cwe':21B 'delet':45B,100C,116C 'denial':144C 'detail':112C 'disabl':72B 'disclosur':152C 'enforc':128C 'expos':75B 'filter':119C 'fk':121C 'ghsa':13A 'ghsa-p9x3-w98f-7j3q':12A 'github.com':163C 'github.com/bugbunny-research)':162C 'host':28B 'id':69B,109C,123C,140C 'impact':130C 'invalid':147C 'issu':155C 'know':67B 'knowledg':136C 'known':111C 'limit':131C 'mcp':6A,23B,31B,63B,81C,104C 'mcptokenservice.get':113C 'miss':2A 'nocodb':1A,20A,24B,29B 'oper':8A 'own':38B 'ownership':3A,88C,129C 'p9x3':14A 'packag':25B 'primari':141C 'read':42B,97C 'regener':43B,98C 'regeneratetoken':114C 'report':157C 'requir':132C 'research':161C 'risk':142C 'role':52B,134C 'scope':77B,150C 'self':27B 'self-host':26B 'servic':33B,83C,146C 'summari':79C 'target':138C 'token':7A,32B,40B,64B,73B,78B,82C,87C,105C,108C,139C,148C,151C 'user':48B,61B,102C,122C 'valid':4A,86C 'w98f':15A 'within':92C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host NocoDB with MCP tokens enabled and give users the Creator role in a shared base. The flaw needs an account with Creator access and the target token's ID, so instances where everyone is an admin or MCP is unused carry less practical risk. Teams on hosted NocoDB Cloud are handled by the vendor.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nocodb"],"ptokens":["nocodb"],"labels":["cwe639","mcp","medium","nocodb","npm","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-03-02T19:53:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-p9x3-w98f-7j3q","url":"https://github.com/advisories/GHSA-p9x3-w98f-7j3q","severity":"medium","published_at":"2026-03-02T19:53:41+00:00","modified_at":"2026-11-05T22:42:12+00:00","first_seen_at":"2026-11-05T22:46:57+00:00","fetched_at":"2026-11-05T22:52:11+00:00","note":null}],"documents":[{"id":81206,"url":"https://api.github.com/repos/nocodb/nocodb/security-advisories/GHSA-p9x3-w98f-7j3q","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":81207,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-p9x3-w98f-7j3q","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":80893,"url":"https://github.com/nocodb/nocodb/releases/tag/0.301.3","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":81209,"url":"https://github.com/nocodb/nocodb/commit/4e736ee40951c7b4f9760f372780e0712c44b9dd","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[{"type":"epss","score":0.00185,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28361"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}