CVE-2026-126270: NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoint
NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
NocoDB instances running versions before 2026.09.1 are exposed because the affected aggregated meta info route can be accessed without authentication.
What does an attacker need to exploit this issue?
An attacker only needs network access to the affected endpoint. No account, privileges, or user interaction are required.
What information can be disclosed?
Anonymous callers can enumerate instance-wide metadata, including bases, user counts, counts of shared and password-protected views, webhook counts, and live row counts for each base.
What is the risk if the endpoint is repeatedly requested?
Repeated requests can amplify database query load, creating an availability impact in addition to the metadata disclosure.
How can exposure be remediated?
Upgrade NocoDB to version 2026.09.1 or later.