CVE-2026-126283

CVSS 8.8 (high) · published 2026-11-13

NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base the token owner belongs to, including bases joined later.

Weakness: CWE-863

Source: NVD CVE-2026-126283

References

• https://github.com/nocodb/nocodb/security/advisories/GHSA-7395-6gh4-5q8p
• https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-incorrect-authorization-via-base-scoped-api-tokens

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.