PT-2026-133649
CVE-2026-119715
·
Published
2026-10-30
·
Updated
2026-10-30
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.
Found an issue in the description? Have something to add? Feel free to write us 👾