CVE-2026-126283

EUVD-2026-125238
NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base the token owner belongs to, including bases joined later.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 38.95%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
nocodbnocodb
𝑥
< 2026.8.0
CNA
Common Weakness Enumeration
References
https://github.com/nocodb/nocodb/security/advisories/GHSA-7395-6gh4-5q8p
https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-incorrect-authorization-via-base-scoped-api-tokens