Threat database

CVE-2026-116123 is a medium-severity vulnerability in NocoDB version 2026.07.0 involving improper restriction of excessive authentication attempts in the validatePassword function within /auth/user/signup. The vulnerability can be exploited remotely but requires high complexity and is difficult to exploit. The vendor has documented this behavior as intentional and has not provided a response or patch, deleting the related GitHub issue without explanation.

CVE-2026-116122 is an information disclosure vulnerability in NocoDB version 2026.07.0 affecting the AuthService.validateUser function in the Sign-in Endpoint. The flaw allows remote attackers to manipulate the salt argument, potentially exposing sensitive information. The attack complexity is high, and exploitability is difficult. The vendor has not responded to disclosure attempts and deleted the related GitHub issue. No patch or official fix has been announced.

CVE-2026-116121 is a race condition vulnerability in NocoDB affecting version 2026.08.0. The flaw exists in the processing of the file users.service.ts within the Registration component. Exploitation requires a high level of complexity and is considered difficult. The vulnerability can be exploited remotely without user interaction or privileges. The vendor has not provided a response or patch and deleted the related GitHub issue without explanation.

CVE-2026-116120 is a resource allocation vulnerability in NocoDB version 2026.07 affecting the UserRefreshToken.deleteAllUserToken function within the /auth/user/signup component. The vulnerability allows remote attackers to cause resource allocation issues due to the absence of in-app rate limiting on unauthenticated signup and password-forgot endpoints. Exploitation complexity is high, and the vendor has not provided a response or patch, with the issue reportedly deleted from GitHub without explanation.

CVE-2026-116119 is a medium severity race condition vulnerability in NocoDB version 2026.08.0 affecting the Password-Reset Flow component. The flaw exists in the file packages/nocodb/src/services/users/users.service.ts and can be exploited remotely. The vendor has not provided any response or patch, and the GitHub issue related to this vulnerability was deleted without explanation.