NocoDB EUVD-2026-114120

Exploitation requires that the victim hold an active, signed-in NocoDB session and then visit an attacker-controlled page; the attacker needs no authentication to host that page. The enabling condition is a default-configuration weakness: NocoDB before 2026.08.0 emits neither an X-Frame-Options header nor a CSP frame-ancestors directive on any response - including the authenticated application shell served by gui.middleware.ts and API responses from global.middleware.ts and the on-prem variant - so no origin is excluded from framing a signed-in session. Limiting factors that reduce realistic risk: mandatory user interaction (the victim must be induced to click through an invisible overlay, UI:P), the need for a concurrently authenticated victim, and impact confined to actions the victim's own account can perform (record edits/deletes, sharing changes, collaborator invites); there is no confidentiality or availability impact.

This is a medium-severity clickjacking issue (CWE-1021) with a vendor-provided CVSS 4.0 score of 5.3, and the signals consistently point to a real-but-moderate priority rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) shows a network-reachable flaw requiring no attacker authentication but mandating victim interaction (UI:P), with only limited integrity impact (VI:L) and no confidentiality or availability impact - consistent with UI-redressing rather than direct code or data compromise. No EPSS score was supplied, there is no CISA KEV listing, and no working exploit code is provided, so there is no evidence of active or automated exploitation; the GHSA advisory describes the mechanism but does not publish a weaponized PoC. The vuln.today decision label is 'this_month', which aligns with a patch-on-normal-cadence posture rather than immediate action. The one point to watch: exploitation depends entirely on socially engineering an already-authenticated user into visiting a malicious page and clicking through an invisible overlay, so real-world impact hinges on the attacker luring a logged-in victim - a targeted, interaction-dependent scenario rather than mass remote compromise.

An attacker hosts a malicious web page that transparently frames the authenticated NocoDB interface (which ships no X-Frame-Options or CSP frame-ancestors headers) beneath decoy content. A NocoDB user with an active session is lured to the page and tricked into clicking elements that, unknown to them, actuate NocoDB actions - deleting or modifying records, altering sharing settings, or inviting a collaborator. No public working exploit code is identified at time of analysis, though the mechanism is fully documented in the vendor GHSA advisory.