CVE-2026-126283

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.08.0

Description An incorrect authorization issue exists where base-scoped API tokens function as account-wide credentials. This occurs because the base id associated with the token is neither stored nor verified. Consequently, an attacker possessing a leaked token can read, write, and delete records across all bases the token owner is a member of, including those joined after the token was created.

Recommendations Update NocoDB to version 2026.08.0 or later.