Description
NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nocodb | nocodb | < 2026.07.0 | 2026.07.0 |