CVE-2026-116120
Received Received - Intake

Resource Exhaustion in NocoDB Public API

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllUserToken of the file /auth/user/signup of the component PublicApiLimiterGuard. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The attack is considered to have high complexity. It is stated that the exploitability is difficult. Code-verified absence of in-app rate limiting on the unauthenticated signup and password-forgot endpoints and per-request refresh/OAuth token invalidation, but the vendor documents the pass-through limiter as intentional design. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116120
EUVD
EUVD-2026-109613

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a NocoDB 2026.07

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in NocoDB versions up to 2026.07.0. It involves the function UserRefreshToken.deleteAllUserToken in the file /auth/user/signup under the PublicApiLimiterGuard component. The issue allows remote attackers to manipulate the system into allocating excessive resources. The attack has high complexity and is difficult to exploit. The vendor intentionally designed the system without rate limiting on unauthenticated signup and password-forgot endpoints, and token invalidation is per-request.

Impact Analysis

An attacker could exploit this to cause resource exhaustion on the server, potentially leading to degraded performance or denial of service. Sensitive data exposure or unauthorized actions may occur due to insufficient rate limiting and token management.

Mitigation Strategies

Upgrade NocoDB to the latest version beyond 2026.07.0 to address the resource allocation issue in the UserRefreshToken.deleteAllUserToken function. Ensure rate limiting is properly configured on unauthenticated signup and password-forgot endpoints as the vendor's pass-through limiter may not be sufficient.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116120. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart