中
6.9
NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation
CVE-2026-121736
SecPulse初出
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| nocodbnocodb |
0.300.0 以上 2026.08.0 未満→ 2026.08.0 |
2026.08.0 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_id, redirect_uri and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting.
出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
参照URL
- advisory nvd.nist.gov
- advisory github.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web github.com