NocoDB CVE-2026-116121

Exploitation requires winning a timing-dependent race condition (CWE-362) in the user registration processing within users.service.ts; an attacker must send concurrently executing requests against the registration flow of a network-reachable NocoDB instance (version up to 2026.08.0). No authentication and no user interaction are required per the vector (PR:N/UI:N), but the high attack complexity (AC:H) is the primary limiting factor: the vendor assesses exploitability as 'difficult', meaning reliable triggering depends on precise concurrent timing that an attacker does not fully control, and the sources do not describe the specific window or state that must be hit.

This is a moderate-severity issue that does not rise to an urgent priority, and the signals are largely consistent on that point. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N, 6.3) describes a remotely reachable, unauthenticated flaw whose exploitation carries high attack complexity (AC:H) and only a low integrity impact (VI:L), with no confidentiality or availability impact. The vuln.today decision label is 'this_month' - meaningful but explicitly not act_now or emergency. There is no CISA KEV listing and no EPSS score in the supplied data, so no quantitative exploitation-probability signal is available, and no confirmed public exploit code is present. One notable conflict: the Tags include 'Information Disclosure', yet the CVSS vector sets VC:N (no confidentiality impact) and only VI:L - the tag and the scored impact disagree, so the 'information disclosure' characterization is not supported by the vector and should be verified. Additionally, the race-condition trigger is described only at a high level (processing in users.service.ts of the Registration component); the available sources do not state exactly how the race is won. Overall: a genuine but hard-to-exploit, low-impact integrity flaw, appropriately treated as a scheduled-patch item rather than an emergency.

A remote, unauthenticated attacker issues tightly timed concurrent requests against the NocoDB registration endpoint, attempting to win a race in the account-registration processing path (users.service.ts) to manipulate registration state. Because the flaw carries high attack complexity, success requires precise timing of overlapping requests and is assessed as difficult to reproduce. No confirmed public exploit code was identified at time of analysis.