NocoDB CVE-2026-121736

No special conditions beyond network reachability - the POST /api/v2/oauth/authorize route in oauth.controller.ts was guarded only by the authentication-optional global guard and carried no access-control decorator, so a default deployment with the OAuth module exposed accepts anonymous requests (client_id, redirect_uri, approved=true) and inserts a record because the user foreign key is nullable. The key LIMITING factors, per the advisory, are: the endpoint rate limiter bounds how many ownerless rows can be created; no access token is ever issued (the token exchange fails on the undefined user), and no data is exposed, so impact is confined to junk authorization-code records rather than account compromise. Exploitation requires that the instance exposes the OAuth authorize endpoint and runs a version at or above 0.300.0 and below 2026.08.0.

This is a genuinely low-to-moderate priority issue despite the missing-authentication classification. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly reflects that the POST /api/v2/oauth/authorize endpoint is reachable by remote, unauthenticated attackers with no user interaction over the network, but the impact metrics are the decisive signal: VC:N/VI:L/VA:N, meaning no confidentiality loss, only low integrity impact, and no availability impact. The GHSA advisory (GHSA-532v-ccph-m3xg) is explicit that the flaw does NOT extend into a usable OAuth grant - the subsequent token exchange resolves the absent user to nothing and fails, so no access token is ever minted and no data is exposed. The only real-world effect is insertion of unbounded ownerless authorization-code rows, bounded by the endpoint's rate limiter. No EPSS score, KEV listing, or SSVC automatable/technical-impact fields were supplied; the only priority signal is vuln.today's 'this_month' decision label, which is consistent with a patch-this-cycle rather than drop-everything issue. There is no KEV entry and no PoC/exploit reference in the input, so there is no public exploit identified at time of analysis. Net: a real but bounded data-integrity/junk-row nuisance, not a high-urgency account-takeover or data-exposure vulnerability. The headline 6.9 and CWE-306 label somewhat overstate operational risk relative to the confirmed no-token, no-data-exposure impact.

A remote unauthenticated attacker sends anonymous POST requests to /api/v2/oauth/authorize with client_id, redirect_uri and approved=true, causing the server to insert authorization-code records that have no associated user. Repeating this (subject only to the endpoint rate limiter) lets the attacker accumulate unbounded ownerless rows in the authorization-code store, a database-integrity/junk-data problem. No public exploit was identified in the provided sources, and per the vendor advisory no access token can be obtained and no data is exposed through this path.