NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint
概要
NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve full OAuth client records by querying the public client lookup route in oauth.controller.ts. Attackers who know or guess a client identifier can obtain the registration access t...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| nocodbnocodb |
2026.06.2 未満→ 2026.06.2 |
2026.06.2 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve full OAuth client records by querying the public client lookup route in oauth.controller.ts. Attackers who know or guess a client identifier can obtain the registration access token to modify or delete registrations, plus the bcrypt client secret hash and owner's internal identifier.
出典: CVE.org (CVE Program・cvelistV5) NVD