CVE-2026-126282

EUVD-2026-125239
NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read, write and schema modification access across all default-workspace bases using their existing session token.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 29.5%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
nocodbnocodb
2026.4.0 ≤
𝑥
< 2026.8.0
CNA
Common Weakness Enumeration
References
https://github.com/nocodb/nocodb/security/advisories/GHSA-jj94-6wwc-qhcx
https://www.vulncheck.com/advisories/nocodb-from-2026.04.0-before-2026.08.0-improper-privilege-management-via-organization-role-update