CVE-2026-116122
Received Received - Intake

Information Disclosure in NocoDB Sign-in Endpoint

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is considered difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116122
EUVD
EUVD-2026-109615

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a NocoDB 2026.07

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in NocoDB up to version 2026.07.0. It affects the AuthService.validateUser function in the Sign-in Endpoint. By manipulating the salt argument, an attacker can disclose sensitive information. The attack is remote but has high complexity and is difficult to exploit.

Impact Analysis

This vulnerability may allow attackers to access sensitive data through information disclosure. Since it affects authentication, unauthorized users might gain access to user credentials or other protected information. The vendor's lack of response increases risk as no patches are confirmed.

Mitigation Strategies

Upgrade NocoDB to a version beyond 2026.07.0 to address the vulnerability in AuthService.validateUser. Monitor vendor communications for patches or updates. If no patch is available, consider disabling affected endpoints or restricting network access to them.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart