CVE-2026-121736

Name of the Vulnerable Software and Affected Versions NocoDB versions 0.300.0 through 2026.07.9

Description Missing authentication in the 'POST /api/v2/oauth/authorize' endpoint allows unauthenticated attackers to create OAuth authorization codes. By sending anonymous requests containing the client id, redirect uri, and approved=true variables, attackers can insert an unbounded number of ownerless authorization code records, constrained only by rate limiting.

Recommendations Update NocoDB to version 2026.08.0 or later. Restrict access to the 'POST /api/v2/oauth/authorize' endpoint to minimize the risk of exploitation.