CVE-2026-126290
Received Received - Intake

NocoDB Information Disclosure via Missing Query Flag

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126290
EUVD
EUVD-2026-125231

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nocodb nocodb to 2026.07.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NocoDB before version 2026.07.0 has an information disclosure vulnerability in the base-integrations.service.ts file. Authenticated base members can read private integration configurations by omitting a specific query flag, bypassing ownership checks to access stored connection credentials of other users.

Detection Guidance

To detect this vulnerability, check NocoDB versions before 2026.07.0. Inspect network traffic for base integration requests missing the required query flag. Look for unauthorized access to private integration configurations or credentials in logs.

Impact Analysis

An attacker with base access could steal private integration credentials, leading to unauthorized access to external systems or data. This could result in data breaches, account takeovers, or further network compromise depending on the integration's permissions.

Compliance Impact

This vulnerability likely violates GDPR (data protection) and HIPAA (health data privacy) by exposing sensitive credentials and potentially unauthorized access to personal or health data. Organizations using affected versions may face compliance violations, fines, or legal consequences.

Mitigation Strategies

Upgrade NocoDB to version 2026.07.0 or later immediately. Review and revoke any potentially exposed credentials. Monitor for unauthorized access or data exfiltration attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126290. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...