CVE-2026-126282

CVSS 8.6 (high) · published 2026-11-13

NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read, write and schema modification access across all default-workspace bases using their existing session token.

Weakness: CWE-269

Source: NVD CVE-2026-126282

References

• https://github.com/nocodb/nocodb/security/advisories/GHSA-jj94-6wwc-qhcx
• https://www.vulncheck.com/advisories/nocodb-from-2026.04.0-before-2026.08.0-improper-privilege-management-via-organization-role-update

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.