EUVD-2026-38610
GHSA-g72g-r7m4-9x4g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the prerequisite of prior OAuth token possession; C:L and I:L capture retained unauthorized account access; AV:N because token usage is network-based.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called from passwordChange, passwordForgot, and passwordReset. OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password, leaving an attacker-issued OAuth grant valid after the user believed they had locked the attacker out. This vulnerability is fixed in 2026.05.1.
AnalysisAI
OAuth token persistence in NocoDB allows an attacker who previously obtained a user's OAuth credentials to maintain unauthorized account access even after the victim performs a password change, reset, or recovery - the exact security actions taken to revoke attacker access. All NocoDB versions up to 2026.05.0 (npm package: nocodb) are affected due to revokeAllOAuthTokensByUser being implemented as an empty stub in the users service, meaning no OAuth or refresh tokens were ever actually invalidated by any of the three password security flows. No public exploit has been identified at time of analysis, and a vendor-released patch is available in 2026.05.1.
Technical ContextAI
NocoDB is an open-source platform (npm package: nocodb, CPE: cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*) that exposes relational databases through a spreadsheet-style UI. The vulnerability resides in the users service, where revokeAllOAuthTokensByUser was wired into three password lifecycle handlers - passwordChange, passwordForgot, and passwordReset - but was coded as an empty stub with no implementation body. Consequently, those handlers never called OAuthToken.revokeAllByUser(userId), never deleted token rows from the OAuth token store, never invalidated related auth caches, and never rotated token_version. CWE-613 (Insufficient Session Expiration) is the applicable root cause class: credential lifecycle events that should trigger session termination silently fail to do so, leaving OAuth access and refresh tokens valid indefinitely. The advisory notes this is a sibling to GHSA-r989-7g3j-wjhw (refresh token revocation), and the 2026.05.1 fix addresses both consistently across all three flows.
RemediationAI
Vendor-released patch: NocoDB 2026.05.1. Upgrade the nocodb npm package to 2026.05.1 or later, which replaces the empty stub with a real implementation that calls OAuthToken.revokeAllByUser(userId), deletes OAuth token rows, invalidates related auth caches, and rotates token_version across all three flows (passwordChange, passwordForgot, passwordReset). The vendor advisory is at https://github.com/nocodb/nocodb/security/advisories/GHSA-g72g-r7m4-9x4g. If an immediate upgrade is not possible, administrators can manually purge active OAuth tokens from the database for any user who has recently changed or reset their password - this requires direct database access to delete rows from the OAuth token table and is a one-time remediation per affected user, not a permanent fix. As a compensating control, disabling OAuth authentication entirely (if the deployment can function without it) eliminates the token persistence risk, though at the cost of OAuth-based SSO functionality. Note that this fix is bundled with the GHSA-r989-7g3j-wjhw refresh token revocation fix in the same 2026.05.1 release.
NocoDB spreadsheet platform prior to 0.301.0 has a stored XSS vulnerability (CVSS 9.0) that enables code execution throu
Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+. Rated high severity (CVSS 8.8), thi
Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+. Rated high severity (CVSS 8.8), this
NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access
With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's con
Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+. Rated
Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0. Rated medium severity (CVSS 6.5), this vul
Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0. Rated medium se
NocoDB versions prior to 0.301.0 contain an open redirect vulnerability in the login flow where the `continueAfterSignIn
NocoDB is software for building databases as spreadsheets. Rated medium severity (CVSS 5.4), this vulnerability is remot
Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+. Rated medium severity (CVSS 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7. Rated medium severity (CVSS 5.4)
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today