CVE-2026-126292

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.06.1

Description An information disclosure issue exists in the profile update handler within users.service.ts. The system returns the stored user record without applying the user-serialization filter, which exposes the bcrypt password hash, salt, and session token counter. An attacker with a stolen or hijacked session can update the profile to retrieve the password hash and salt for offline cracking.

Recommendations Update NocoDB to version 2026.06.1 or later.