PT-2026-42679

CVE-2026-46553

Published

2026-05-21

Updated

2026-06-25

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NocoDB (affected versions not specified)

Description An issue exists where the upload-by-URL path fails to enforce the NC ATTACHMENT FIELD SIZE limit against the remote file's advertised Content-Length or the decoded length of a data: URI. This allows authenticated users with upload permissions to bypass configured per-file size limits, potentially exceeding storage and bandwidth caps.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Bugbunny-Research

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling

Related identifiers

CVE-2026-46553