CVE-2026-46554

Deferred Deferred - Pending Action

Authentication Bypass in NocoDB via Stale API Tokens

Publication date: 2026-06-23

Last updated on: 2026-06-24

Assigner: GitHub, Inc.

Description

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, deleted API tokens continued to authenticate requests until their cache entry expired, because the auth cache was not invalidated by token value at deletion time. The API token deletion path removed the database row but did not evict the token-value keyed entry from the auth cache. The auth middleware therefore continued to accept the deleted token until the cache entry aged out, leaving a deletion-to-revocation window of up to three days. This vulnerability is fixed in 2026.04.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-23

Last Modified

2026-06-24

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-46554

Affected Vendors & Products

Vendor	Product	Version / Range
nocodb	nocodb	2026.04.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability affects NocoDB, a software used for building databases as spreadsheets. Before version 2026.04.4, when an API token was deleted, it continued to authenticate requests until its cache entry expired. This happened because the authentication cache was not invalidated based on the token value at the time of deletion.

Specifically, deleting an API token removed its database row but did not remove the corresponding token entry from the authentication cache. As a result, the authentication middleware still accepted the deleted token until the cache entry aged out, which could take up to three days.

This created a window of vulnerability between token deletion and revocation, allowing potentially unauthorized access during that time. The issue was fixed in version 2026.04.4.

Impact Analysis

This vulnerability can impact you by allowing deleted API tokens to remain valid for up to three days after deletion. During this window, unauthorized users could potentially use these tokens to access your NocoDB instance.

This extended validity period increases the risk of unauthorized access, data exposure, or manipulation, especially if tokens are deleted in response to a suspected compromise but remain active due to the caching issue.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade NocoDB to version 2026.04.4 or later, where the issue with deleted API tokens continuing to authenticate requests has been fixed.

Compliance Impact

The vulnerability allows deleted API tokens to remain valid for authentication for up to three days due to cache invalidation issues. This delay in revoking access could lead to unauthorized access to sensitive data during that window.

Such unauthorized access risks may impact compliance with standards and regulations like GDPR and HIPAA, which require timely revocation of access to protect personal and sensitive information.

Therefore, the vulnerability could potentially hinder adherence to these regulations by failing to immediately enforce token revocation, increasing the risk of data exposure or unauthorized data processing.

Hi! I’m here to help you understand CVE-2026-46554. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70