Executive Summary

This vulnerability affects NocoDB, a software used for building databases as spreadsheets. Before version 2026.04.4, when an API token was deleted, it continued to authenticate requests until its cache entry expired. This happened because the authentication cache was not invalidated based on the token value at the time of deletion.

Specifically, deleting an API token removed its database row but did not remove the corresponding token entry from the authentication cache. As a result, the authentication middleware still accepted the deleted token until the cache entry aged out, which could take up to three days.

This created a window of vulnerability between token deletion and revocation, allowing potentially unauthorized access during that time. The issue was fixed in version 2026.04.4.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing deleted API tokens to remain valid for up to three days after deletion. During this window, unauthorized users could potentially use these tokens to access your NocoDB instance.

This extended validity period increases the risk of unauthorized access, data exposure, or manipulation, especially if tokens are deleted in response to a suspected compromise but remain active due to the caching issue.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade NocoDB to version 2026.04.4 or later, where the issue with deleted API tokens continuing to authenticate requests has been fixed.

Useful 0 Not Useful 0