NocoDB EUVD-2026-109612

Exploitation targets the password-reset flow implemented in packages/nocodb/src/services/users/users.service.ts and hinges on a race condition, so the attacker must reliably win a concurrency/timing window in that reset logic; the exact trigger sequence is not described in the available sources. The CVSS 4.0 vector sets PR:L, so a low-privileged authenticated account is required (not fully anonymous), and UI:P means the attack depends on a user/victim participating in the reset flow. These factors - required authentication, required user interaction, and the inherent unreliability of winning a race - meaningfully limit practical exploitation despite network reachability. Affected: NocoDB up to and including 2026.08.0; no fixed version is listed in the available data.

This is a medium-severity issue (CVSS 4.0 base 5.1) whose real-world priority is modest. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L) indicates a network-reachable flaw that still requires an attacker to hold low privileges (PR:L) and depends on victim interaction (UI:P), with only low impact across confidentiality, integrity, and availability - consistent with a password-reset race condition (CWE-362) that leaks or crosses limited state rather than granting full account takeover. The vuln.today decision label is 'this_month', i.e. worth patching on a normal cycle, not an emergency. There is no CISA KEV listing and no EPSS score was supplied, so exploitation probability cannot be quantified and there is no evidence of active exploitation. The reported GitHub issue (14684) was deleted by the vendor and no working exploit code is confirmed in the input, so there is no public exploit identified at time of analysis. A notable conflict: the published CVSS 4.0 uses AC:L, yet the flaw is explicitly a race condition, which normally implies a timing-dependent (higher-complexity) trigger - treat the AC:L as optimistic. Overall this is a genuine but low-urgency, authenticated, interaction-dependent weakness rather than a high-risk mass-exploitation candidate.

A low-privileged but authenticated NocoDB user abuses a timing window in the password-reset flow by racing concurrent requests, causing the reset logic to mishandle state and expose or alter limited reset-related data tied to another account's flow. Success depends on winning the race and on the victim participating in a reset, and the precise trigger is not described in the available sources. No confirmed working exploit code was provided.