NocoDB EUVD-2026-109616

Exploitation targets the validatePassword function reachable via the /auth/user/signup endpoint in NocoDB versions up to 2026.07.0, abusing the lack of restriction on excessive authentication attempts. The specific trigger beyond 'manipulation' of this endpoint is not described in the available sources. Key limiting factors: the CVSS vector marks high attack complexity (AC:H) and the vendor describes exploitability as 'difficult' and the behavior as intentional, and impact is confined to low confidentiality (VC:L) with no integrity or availability effect; the endpoint requires no authentication (PR:N) but there is no vendor-confirmed fix or mitigation, as the vendor disputes the issue.

Signals point to a low-to-moderate real-world priority despite the medium CVSS 4.0 base score of 6.3. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) indicates a remote, unauthenticated issue but with high attack complexity and only low confidentiality impact - no integrity or availability impact. No EPSS score is provided in the input, this CVE is not listed in CISA KEV, and no confirmed public exploit code is present; the only related issue reference (GitHub issue 14688) was deleted by the vendor. The vuln.today decision label is 'this_month' rather than act_now or emergency, which is consistent with a non-urgent finding. A notable conflict: the vector scores PR:N (unauthenticated) and AV:N (network) yet the vendor explicitly documents the missing rate-limiting as intentional behavior and describes exploitability as 'difficult,' so the practical attacker value is limited to slow brute-force style abuse of the signup/password validation path rather than direct compromise. This reads as a genuine-but-low-severity hardening gap, not a high-urgency threat.

A remote attacker without an account repeatedly submits password-validation requests to the /auth/user/signup endpoint, exploiting the absence of effective throttling on excessive authentication attempts (CWE-307). Because attack complexity is high and the vendor considers the behavior intentional, success is slow and yields only limited information disclosure. No public exploit identified at time of analysis.