CVE-2026-116123
Received Received - Intake

Authentication Bypass in NocoDB

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The vendor documents this as intentional. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116123
EUVD
EUVD-2026-109616

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a NocoDB 2026.07

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-799 The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in NocoDB versions up to 2026.07.0. It involves the function validatePassword in the file /auth/user/signup, which improperly restricts excessive authentication attempts. This allows remote attackers to exploit it with high complexity and difficulty.

Impact Analysis

The vulnerability could allow unauthorized users to repeatedly attempt authentication, potentially leading to account compromise or unauthorized access to sensitive data. However, the attack is difficult to execute due to high complexity.

Mitigation Strategies

Update NocoDB to the latest version beyond 2026.07.0 to address the improper restriction of authentication attempts. Monitor authentication logs for unusual activity and consider implementing rate limiting or account lockout mechanisms.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116123. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart