CVE-2026-126281
Received Received - Intake

NocoDB Missing Authorization in Integration Copy

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126281
EUVD
EUVD-2026-125240

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nocodb nocodb to 2026.08.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NocoDB before version 2026.08.0 has a missing authorization vulnerability in the integration creation process. Authenticated users with the Creator role can copy an existing integration and decrypt its stored connection credentials without verifying ownership or private status. This allows them to access database host, username, and password from other users' private integrations by guessing or enumerating integration IDs.

Detection Guidance

Check NocoDB version with: docker inspect <container_name> | grep NOCODB_VERSION or npm list -g nocodb. Monitor for unauthorized integration creation events in logs. Look for suspicious API calls to /api/v1/db/integrations/copy with guessed integration IDs.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive database credentials, including host, username, and password, from other users' private integrations. Attackers could use this to gain access to databases, exfiltrate data, or perform further attacks on connected systems. The impact is high on confidentiality as credentials are exposed without integrity or availability impact.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA, which mandate strict access controls and protection of sensitive data. Exposure of database credentials could lead to unauthorized data access, breaching confidentiality obligations and potentially resulting in regulatory penalties or fines.

Mitigation Strategies

Upgrade NocoDB to version 2026.08.0 or later immediately. Review integration ownership and permissions. Disable integration creation for non-admin users until patched. Monitor for unauthorized credential exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126281. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...