CVE-2026-126288

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.06.2

Description An information disclosure issue exists where unauthenticated attackers can retrieve full OAuth client records. This is achieved by querying the public client lookup route in oauth.controller.ts. Attackers who possess or guess a client identifier can obtain the registration access token, the bcrypt client secret hash, and the owner's internal identifier, potentially allowing them to modify or delete registrations.

Recommendations Update NocoDB to version 2026.06.2 or later.