NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 13 Nov 2026 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own. | |
| Title | NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy | |
| First Time appeared |
Nocodb
Nocodb nocodb |
|
| Weaknesses | CWE-862 | |
| CPEs | cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Nocodb
Nocodb nocodb |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-13T09:36:38.488Z
Reserved: 2026-11-10T20:14:15.972Z
Link: CVE-2026-126281
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-13T10:17:31.517
Modified: 2026-11-13T10:17:31.517
Link: CVE-2026-126281
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses