NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoint
Summary
NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| nocodbnocodb |
< 2026.09.1→ 2026.09.1 |
2026.09.1 |
Original description The description as published by the source.
NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load.
Source: CVE.org (CVE Program・cvelistV5) NVD