NocoDB CVE-2026-116122

Exploitation targets the Sign-in Endpoint specifically, via manipulation of the 'salt' argument handled by the AuthService.validateUser function in NocoDB versions up to 2026.07.0. Per the CVSS vector it is remote and unauthenticated (AV:N, PR:N, UI:N), but attack complexity is high (AC:H) and the input explicitly rates exploitability as 'difficult,' indicating conditions not fully under the attacker's control must align for success. The precise trigger beyond 'manipulation of the salt argument' is not described in the available sources, and no special configuration or deployment mode is cited as a prerequisite. The practical limiting factor is the high complexity/low reliability of the attack combined with low-only confidentiality impact (VC:L); there is no integrity or availability impact.

This is a moderate, lower-priority issue rather than an urgent one. The CVSS 4.0 base score is 6.3 (Medium), and the vector tells a consistent story: network-reachable (AV:N) and unauthenticated (PR:N, UI:N), but with explicitly high attack complexity (AC:H) and only low confidentiality impact (VC:L) with no integrity or availability impact (VI:N/VA:N). The input itself echoes this, describing exploitability as 'difficult.' There is no KEV listing and no EPSS score in the provided data, so there is no evidence of active exploitation or a high predicted exploitation probability; no public exploit or working PoC is identified in the references. The vuln.today decision label is 'this_month,' i.e. routine scheduled remediation, not act_now or emergency. The signals are internally consistent - high complexity plus low impact plus no exploitation evidence - pointing to a genuine but low-urgency information-disclosure flaw. Two caveats reduce confidence in the metadata rather than the severity: the vulnerability was reported by VulDB (a third party), and the vendor deleted the referenced GitHub issue (#14687) and did not respond to disclosure, so the mechanism and affected-version details have not been vendor-confirmed.

A remote, unauthenticated attacker repeatedly interacts with the NocoDB sign-in endpoint, manipulating the 'salt' argument processed by AuthService.validateUser to coax the service into disclosing information it should not reveal. Because attack complexity is rated high and exploitability 'difficult,' success is not reliable and likely requires conditions outside the attacker's direct control. No public exploit or verified working PoC is identified in the available sources.