CVE-2026-126292
Received Received - Intake

NocoDB Information Disclosure via Profile Update

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126292
EUVD
EUVD-2026-125229

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nocodb nocodb to 2026.06.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NocoDB before version 2026.06.1 has an information disclosure vulnerability in the profile update handler. When a user updates their profile, the system returns the full user record without applying a serialization filter. This exposes sensitive data like bcrypt password hashes, salt values, and session token counters to attackers.

Impact Analysis

If you use a vulnerable version of NocoDB, attackers with a stolen or hijacked session could exploit this flaw to retrieve your bcrypt password hash and salt. They could then attempt offline cracking to recover your password, potentially gaining full access to your account.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive user data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. Exposure of password hashes and salts violates these standards.

Mitigation Strategies

Upgrade NocoDB to version 2026.06.1 or later to address the information disclosure vulnerability in the profile update handler.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...