CVE-2026-119715 Details
Description
NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.
A clickjacking vulnerability has been identified in NocoDB versions prior to 2026.08.0. The issue arises because the application does not send any X-Frame-Options or Content-Security-Policy frame-ancestors headers, allowing any origin to embed the authenticated NocoDB interface. This lack of frame control headers can be exploited by overlaying the NocoDB interface beneath attacker-controlled content, potentially leading to unauthorized modifications or deletions of records, changes in sharing settings, or invitations to collaborators, all while the user believes they are interacting with a different page.
Users can update to NocoDB version 2026.08.0 or later, where this vulnerability has been patched. Instructions for updating can be found in the NocoDB documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nocodb/nocodb | [email protected] | ProductSource CodeVendor |
| https://github.com/nocodb/nocodb/commit/42128735eba328d157c2e90b98795cb248dc0847 | [email protected] | Source CodeVendor |
| https://github.com/nocodb/nocodb/releases/tag/2026.08.0 | [email protected] | Release NotesVendor |
| https://github.com/nocodb/nocodb/security/advisories/GHSA-3rj6-rvwh-j2xg | [email protected] | AdvisoryRemedyVendor |
| https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-clickjacking-via-missing-frame-control-headers | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1021 | Improper Restriction of Rendered UI Layers or Frames | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NocoDB | < 2026.08.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |