Description
NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nocodb | nocodb | < 2026.08.0 | 2026.08.0 |
References
- GitHub Security Advisory (GHSA-3rj6-rvwh-j2xg) vendor-advisory
- https://github.com/nocodb/nocodb/commit/42128735eba328d157c2e90b98795cb248dc0847 patch
- nocodb 2026.08.0 Release Notes release-notes
- https://github.com/nocodb/nocodb product
- VulnCheck Advisory: NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers third-party-advisory