Skip to main content

NocoDB CVE-2026-53926

| EUVDEUVD-2026-38610 MEDIUM
Insufficient Session Expiration (CWE-613)
2026-06-23 GitHub_M GHSA-g72g-r7m4-9x4g
Information Disclosure Nocodb
6.3
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.8 MEDIUM

AC:H reflects the prerequisite of prior OAuth token possession; C:L and I:L capture retained unauthorized account access; AV:N because token usage is network-based.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jun 23, 2026 - 23:02 EUVD
Source Code Evidence Fetched
Jun 23, 2026 - 20:51 vuln.today
Analysis Generated
Jun 23, 2026 - 20:51 vuln.today

DescriptionCVE.org

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called from passwordChange, passwordForgot, and passwordReset. OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password, leaving an attacker-issued OAuth grant valid after the user believed they had locked the attacker out. This vulnerability is fixed in 2026.05.1.

AnalysisAI

OAuth token persistence in NocoDB allows an attacker who previously obtained a user's OAuth credentials to maintain unauthorized account access even after the victim performs a password change, reset, or recovery - the exact security actions taken to revoke attacker access. All NocoDB versions up to 2026.05.0 (npm package: nocodb) are affected due to revokeAllOAuthTokensByUser being implemented as an empty stub in the users service, meaning no OAuth or refresh tokens were ever actually invalidated by any of the three password security flows. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain victim's OAuth access/refresh tokens via phishing or prior compromise
Delivery
Victim performs password change or reset expecting session termination
Exploit
Empty stub silently skips token revocation
Execution
Attacker continues authenticating with stale OAuth tokens
Impact
Maintain persistent unauthorized access to victim's NocoDB databases
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the attacker already possesses valid OAuth access and/or refresh tokens for the target NocoDB user account, obtained prior to the victim's password security event. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 4.0 score of 6.3 with AT:P correctly signals that exploitation is conditional - the attacker must have obtained valid OAuth tokens before the victim's remediation attempt. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who previously obtained a NocoDB user's OAuth access and refresh tokens - through phishing, a malicious OAuth application grant, or credential theft - continues to use those tokens to authenticate against the victim's account after the victim performs a password reset specifically to terminate unauthorized sessions. Because the revocation stub does nothing, the attacker's OAuth session silently persists with full account-level access to the victim's databases and spreadsheets. …
Remediation Vendor-released patch: NocoDB 2026.05.1. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nocodb

View all
CVE-2026-24769 CRITICAL POC
9.0 Jan 28

NocoDB spreadsheet platform prior to 0.301.0 has a stored XSS vulnerability (CVSS 9.0) that enables code execution throu
CVE-2022-2064 HIGH POC
8.8 Jun 13

Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+. Rated high severity (CVSS 8.8), thi
CVE-2022-2063 HIGH POC
8.8 Jun 13

Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+. Rated high severity (CVSS 8.8), this

CVE-2023-35843 HIGH POC
7.5 Jun 19

NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access
CVE-2022-2339 HIGH POC
7.5 Jul 07

With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's con
CVE-2022-2062 HIGH POC
7.5 Jun 13

Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+. Rated

CVE-2023-5104 MEDIUM POC
6.5 Sep 21

Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0. Rated medium severity (CVSS 6.5), this vul
CVE-2022-3423 MEDIUM POC
6.5 Oct 07

Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0. Rated medium se
CVE-2026-24768 MEDIUM POC
6.1 Jan 28

NocoDB versions prior to 0.301.0 contain an open redirect vulnerability in the login flow where the `continueAfterSignIn
CVE-2025-27506 MEDIUM POC
5.4 Mar 06

NocoDB is software for building databases as spreadsheets. Rated medium severity (CVSS 5.4), this vulnerability is remot
CVE-2022-2079 MEDIUM POC
5.4 Jun 14

Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+. Rated medium severity (CVSS 5.4
CVE-2022-2022 MEDIUM POC
5.4 Jun 07

Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7. Rated medium severity (CVSS 5.4)

Same weakness CWE-613 – Insufficient Session Expiration

View all
CVE-2022-36179 CRITICAL POC
9.8
CVE-2026-26342 CRITICAL POC
9.8
CVE-2016-5069 CRITICAL POC
9.8
CVE-2024-29401 CRITICAL POC
9.8
CVE-2023-49091 CRITICAL POC
9.8
CVE-2023-5865 CRITICAL POC
9.8
CVE-2023-5838 CRITICAL POC
9.8
CVE-2023-1854 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-53926 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy