---
id: "CVE-2026-28361"
page: "https://infrastack.ai/live/CVE-2026-28361"
kind: "vulnerability"
aliases: ["CVE-2026-28361", "GHSA-p9x3-w98f-7j3q"]
title: "NocoDB Missing Ownership Validation in MCP Token Operations"
severity: "medium"
cvss: null
epss: 0.00185
exploited: false
status: "open"
category: "package"
products: [{"name": "nocodb", "fixed": ["0.301.3"], "affected": "<= 0.301.2", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-639", "mcp", "nocodb", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "mcp-unused"]
published_at: "2026-03-02T19:53:41+00:00"
first_seen_at: "2026-11-05T22:46:57+00:00"
updated_at: "2026-11-05T22:48:40+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-p9x3-w98f-7j3q", "first_seen_at": "2026-11-05T22:46:57+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00185, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28361"}]
---

# NocoDB Missing Ownership Validation in MCP Token Operations

Link for people: https://infrastack.ai/live/CVE-2026-28361 (this .md is for agents)

NocoDB's MCP token service does not check who owns a token before reading, regenerating or deleting it. A user with the Creator role in the same base can act on another user's MCP token if they know its ID, which can disable tokens or expose a scoped token.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:nocodb affected <= 0.301.2 fixed 0.301.3

## How to check

- Check the installed version of the npm package `nocodb` (for example `npm ls nocodb`) and compare it to `0.301.3`.
- If you run NocoDB from a container, check the image tag against the release that includes `0.301.3`.

## Fix

- `nocodb` (npm): move to `0.301.3` or later.

## Timeline

- 2026-11-05T22:46:57+00:00 ghsa https://github.com/advisories/GHSA-p9x3-w98f-7j3q

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/nocodb/nocodb/security-advisories/GHSA-p9x3-w98f-7j3q
- [advisory] Maintainer's advisory: github.com https://github.com/nocodb/nocodb/security/advisories/GHSA-p9x3-w98f-7j3q
- [fix] Release: github.com https://github.com/nocodb/nocodb/releases/tag/0.301.3
- [fix] Patch: github.com https://github.com/nocodb/nocodb/commit/4e736ee40951c7b4f9760f372780e0712c44b9dd

## From the sources

### Summary
The MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known.

### Details
`McpTokenService.get()`, `regenerateToken()`, and `delete()` did not filter by `fk_user_id`. The analogous `ApiTokensService` correctly enforced ownership.

### Impact
Limited — requires Creator role and knowledge of target token ID. Primary risk is denial of service (invalidating tokens) and scoped token disclosure.

### Credit
This issue was reported by [@bugbunny-research](https://github.com/bugbunny-research) (bugbunny.ai).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_