CVE-2026-121736: NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation
NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with clientid, redirecturi and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the NocoDB POST /api/v2/oauth/authorize endpoint can attempt exploitation. No account, privileges, or user interaction are required.
What does an attacker need to send to trigger the vulnerable behavior?
The attacker can submit an anonymous request containing client_id, redirect_uri, and approved=true. This causes creation of ownerless OAuth authorization-code records.
What is the practical impact if the endpoint is exposed?
An attacker can create an unbounded number of ownerless authorization-code records. The described constraint is rate limiting.
Are installations running the affected release range vulnerable by default?
The issue is in the POST /api/v2/oauth/authorize handler in NocoDB 0.300.0 before 2026.08.0. The provided information does not identify any additional configuration prerequisite beyond the endpoint being reachable.
How can I check for signs of exploitation?
Review requests to POST /api/v2/oauth/authorize for unauthenticated submissions containing client_id, redirect_uri, and approved=true. Also investigate unexpected ownerless OAuth authorization-code records and unusually high request volume to that endpoint.