CVE-2026-126291

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.06.2

Description An SQL injection issue exists in the base-user.cte.utils.ts file. The software concatenates email addresses of base members directly into the SQL text of queries used to resolve user, created-by, or last-modified-by fields. A registered user can exploit this by setting an email address with a quoted local part containing a single quote, allowing the execution of arbitrary SQL. This can lead to the exposure of user records, API tokens, and data-source credentials.

Recommendations Update NocoDB to version 2026.06.2 or later.