CVE-2026-126281

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.08.0

Description An authorization flaw exists in the integration creation process within the integrations.service.ts file. Specifically, the copy-from logic decrypts connection credentials of a source integration without verifying the owner or the private status flag. Authenticated users with the Creator role can exploit this by providing guessed or enumerated integration identifiers to copy private database hosts, usernames, and passwords from other users into an integration they control.

Recommendations Update NocoDB to version 2026.08.0 or later.