CVE-2026-116120 Details
Description
A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllUserToken of the file /auth/user/signup of the component PublicApiLimiterGuard. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The attack is considered to have high complexity. It is stated that the exploitability is difficult. Code-verified absence of in-app rate limiting on the unauthenticated signup and password-forgot endpoints and per-request refresh/OAuth token invalidation, but the vendor documents the pass-through limiter as intentional design. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
A resource allocation vulnerability exists in NocoDB versions through 2026.07.0, specifically within the PublicApiLimiterGuard component. The issue arises in the UserRefreshToken.deleteAllUserToken function, located in the authentication user signup endpoint. This vulnerability allows for remote exploitation, although it requires high complexity to execute. The absence of effective rate limiting on the unauthenticated signup and password-forgotten endpoints, coupled with per-request refresh or OAuth token invalidation, creates an opportunity for abuse. While the vendor acknowledges this lack of rate limiting as a design choice, they have removed public documentation of the issue without explanation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nocodb/nocodb/ | [email protected] | Vendor |
| https://github.com/nocodb/nocodb/issues/14685 | [email protected] | Broken LinkIssue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-116120 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1004892 | [email protected] | Permission Required |
| https://vuldb.com/vuln/426188 | [email protected] | Permission Required |
| https://vuldb.com/vuln/426188/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NocoDB | <= 2026.07.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |