CVE-2026-126275: NocoDB before 2026.09.0 IDOR in Row Comment Operations
NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated NocoDB user with a Viewer or Creator role on an unrelated base can exploit it. The attacker does not need access to the base containing the targeted comments.
What information does an attacker need to access comments from another base?
The attacker needs the model ID and row ID for the target comment operation. By supplying those identifiers, they can read cross-base row comments and author email addresses.
Can this vulnerability be used to alter what teammates see?
Yes. An attacker can plant decoy tables and duplicate comment IDs to spoof teammates' comments.
Which versions are affected?
NocoDB versions before 2026.09.0 are affected. Upgrading to 2026.09.0 or later addresses the affected version range described here.