CVE-2026-126270

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.09.1

Description A missing authentication issue exists in the aggregated meta info route of utils.controller.ts. This allows unauthenticated attackers to access instance-wide metadata by requesting the endpoint. Exposed information includes the enumeration of bases, user counts, counts of shared and password-protected views, webhook counts, and live per-base row counts. Additionally, repeated requests to this endpoint can increase the database query load.

Recommendations Update NocoDB to version 2026.09.1 or later.