Threats tagged 'ghsa-2jgj-7q9p-vq8v'

NocoDB versions prior to 2026.08.0 have a clickjacking vulnerability due to missing X-Frame-Options and CSP frame-ancestors headers. This allows attackers to embed the authenticated interface in a malicious page and trick signed-in users into performing unintended actions such as modifying or deleting records, changing sharing settings, or inviting collaborators.