Threats affecting pkg:npm/nocodb

NocoDB versions from 0.300.0 up to but not including 2026.08.0 have a missing authentication vulnerability in the POST /api/v2/oauth/authorize endpoint. This flaw allows unauthenticated attackers to create OAuth authorization codes by sending requests with specific parameters, resulting in unbounded creation of ownerless authorization code records. The vulnerability is rated medium severity with a CVSS score of 6.9. A fix is available in version 2026.08.0.