NocoDB EUVD-2026-109613

Exploitation targets the unauthenticated NocoDB signup endpoint /auth/user/signup (and the password-forgot endpoint), which per the researcher lack in-app rate limiting, where each request drives per-request refresh/OAuth token invalidation through UserRefreshToken.deleteAllUserToken and uncapped resource allocation (CWE-770) via the PublicApiLimiterGuard pass-through limiter. No authentication, credentials, or user interaction is required (PR:N/UI:N) against a default deployment. Limiting factors: the attack is explicitly high complexity and 'difficult' (AC:H), so it requires sustained, high-volume request flooding rather than a single call; the vendor treats the pass-through limiter as intentional, implying deployments are expected to enforce rate limiting at an external layer (e.g. reverse proxy/WAF), which would blunt or neutralize the attack; and the per-event impact is low, affecting availability without compromising data confidentiality or integrity.

This is a medium-severity resource-exhaustion issue (CVSS 4.0 base 6.3) whose signals point to low-to-moderate real-world priority rather than an emergency. The vector is favorable to an attacker on access (AV:N, PR:N, UI:N - remote, unauthenticated, no user interaction against the public signup endpoint) but the attack is explicitly rated high complexity (AC:H) and the source states exploitability is 'difficult', and the impact is only low across confidentiality, integrity and availability (VC:L/VI:L/VA:L) with no scope change. The vuln.today decision label is 'this_month' - a scheduled-remediation tier, not 'act_now'/'emergency' - which is consistent with the modest impact and difficult exploitation. There is NO CISA KEV listing and the input provides NO EPSS probability, so there is no evidence of active or probable exploitation; exploitation status is best read as no public working exploit identified. A key conflict must be flagged: the researcher reports code-verified absence of in-app rate limiting on the unauthenticated signup and password-forgot endpoints and per-request refresh/OAuth token invalidation, but the vendor documents the pass-through limiter as intentional design - so whether this is a defect or an accepted design decision is disputed, verify intended deployment (NocoDB is often expected to sit behind an external rate-limiting reverse proxy). The vendor also deleted the GitHub disclosure issue without explanation and did not respond to email contact, so there is no vendor-confirmed fix or affected-version guidance.

A remote, unauthenticated attacker repeatedly sends requests to the NocoDB /auth/user/signup (and password-forgot) endpoints, which lack in-app rate limiting and perform per-request token invalidation via UserRefreshToken.deleteAllUserToken, causing unthrottled allocation of resources and degrading service availability. The CVSS vector rates this high-complexity/difficult (AC:H), so meaningful disruption likely requires sustained high-volume abuse rather than a single request. No verified working exploit code is identified; the GitHub disclosure issue referenced was deleted by the vendor.