CVE-2026-126278

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.08.1

Description A race condition exists in users.service.ts. This issue allows an individual with a valid reset token to execute multiple password changes by submitting concurrent reset requests. The flaw occurs because the slow bcrypt hashing process creates a time window before the token is invalidated, enabling an attacker to overwrite the new password set by the owner and lock them out of the account.

Recommendations Update NocoDB to version 2026.08.1.