CVE-2026-116122: NocoDB Sign-in Endpoint AuthService.validateUser information disclosure
A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is considered difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker must be able to remotely reach the NocoDB sign-in endpoint and manipulate its salt argument. No privileges or user interaction are required, but exploitation is rated high complexity and difficult.
What is the expected impact if exploitation succeeds?
The reported impact is information disclosure only. The available data does not indicate integrity or availability impact.
Which versions should be treated as potentially affected?
NocoDB versions up to and including 2026.07.0 are reported as impacted. The provided data does not identify a fixed version.