CVE-2026-116121: NocoDB Registration users.service.ts race condition
A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can attempt to exploit this issue?
The issue can be attacked remotely and does not require prior privileges or user interaction. However, exploitation requires high complexity and is assessed as difficult.
What is the likely security impact if exploitation succeeds?
The available scoring indicates an integrity impact only, with no stated confidentiality or availability impact. The vulnerability is rated low severity with a CVSS score of 3.7.
Which deployments may be affected?
The affected product is NocoDB, with versions up to 2026.08.0 identified in the available information. The issue is associated with Registration processing in users.service.ts.
Is a vendor fix or mitigation documented?
No fix, workaround, or configuration-based mitigation is provided in the available data. The vendor reportedly did not respond to early disclosure contact, and the related GitHub issue was deleted.