Description
NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base the token owner belongs to, including bases joined later.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nocodb | nocodb | < 2026.08.0 | 2026.08.0 |
References
- GitHub Security Advisory (GHSA-7395-6gh4-5q8p) vendor-advisory
- VulnCheck Advisory: NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens third-party-advisory