Medium 5.3

NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers

CVE-2026-119715 First seen on SecPulse Oct 31, 00:16

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
nocodb	nocodbnocodb	< 2026.08.0→ 2026.08.0	2026.08.0

Original description The description as published by the source.

NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

advisory github.com
advisory github.com
advisory vulncheck.com
advisory nvd.nist.gov
advisory github.com
package github.com
patch github.com
web github.com

Key facts

CVSS v3: Medium 4.3; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4: Medium 5.3; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Published: Oct 31, 2026
First seen on SecPulse: Oct 31, 00:16
GHSA: GHSA-3rj6-rvwh-j2xg
CWE: CWE-1021

NVD GitHub Advisory

Tags(click for explanation)

All

CWE-1021 Nocodb

Detection sources

OSV.dev (Open Source Vulnerabilities)Nov 6, 06:15
NIST National Vulnerability DatabaseNov 5, 08:17
GitHub Security Advisories (Global)Oct 31, 03:32
CVE.org (CVE Program・cvelistV5)Nov 5, 07:55