CVE-2026-116122 Details
Description
A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is considered difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
A security vulnerability allowing information disclosure has been identified in NocoDB versions through 2026.07.0. The issue arises in the AuthService.validateUser function within the Sign-in Endpoint. By manipulating the salt argument, it is possible to leak sensitive information. This vulnerability can be exploited remotely, although it requires a high level of complexity.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nocodb/nocodb/ | [email protected] | Vendor |
| https://github.com/nocodb/nocodb/issues/14687 | [email protected] | Broken LinkIssue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-116122 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1004895 | [email protected] | Permission Required |
| https://vuldb.com/vuln/426190 | [email protected] | Permission Required |
| https://vuldb.com/vuln/426190/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NocoDB | <= 2026.07.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |