CVE-2026-126275

EUVD-2026-125246
NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.16%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
nocodbnocodb
𝑥
< 2026.9.0
CNA
Common Weakness Enumeration
References
https://github.com/nocodb/nocodb/security/advisories/GHSA-x3xv-qpw2-33x6
https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-idor-in-row-comment-operations