Medium 6.9

NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation

CVE-2026-121736 First seen on SecPulse Nov 4, 07:55

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
nocodb	nocodbnocodb	≥ 0.300.0, < 2026.08.0→ 2026.08.0	2026.08.0

Original description The description as published by the source.

NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_id, redirect_uri and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.3; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4: Medium 6.9; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Published: Nov 4, 2026
First seen on SecPulse: Nov 4, 07:55
GHSA: GHSA-532v-ccph-m3xg
CWE: CWE-306

NVD GitHub Advisory

Tags(click for explanation)

CWE

CWE-306

All

Nocodb

Detection sources

OSV.dev (Open Source Vulnerabilities)Nov 5, 12:31
NIST National Vulnerability Database06:36
GitHub Security Advisories (Global)Nov 4, 09:32
CVE.org (CVE Program・cvelistV5)Nov 10, 02:00