PT-2026-146611

CVE-2026-126280

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 4.0

9.1

Critical

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.08.0

Description A race condition exists in the refresh-token rotation process. This occurs because the UserRefreshToken.ts file does not verify the affected-row count during the rotation. Consequently, an attacker who has captured a refresh token can present it simultaneously with the legitimate user to establish a valid authenticated session without triggering a reuse event record.

Recommendations Update NocoDB to version 2026.08.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Komyunghan

Vendors

Affected products

Weakness enumeration

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\'Race Condition\')

Related identifiers