CVE-2026-126281: NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy
NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated NocoDB user with the Creator role can exploit the vulnerable copy-from integration creation path. The attacker must be able to provide a source integration ID, which can be guessed or enumerated.
What information can an attacker obtain?
An attacker can copy another user's private database integration credentials into an integration they own. The exposed information includes the database host, username, and password.
Are private integrations protected by their owner or private setting?
No. In affected versions, the copy-from branch decrypts source credentials without verifying that the requester owns the source integration or that it is not private.
How can I determine whether an instance is affected?
Instances running NocoDB before version 2026.08.0 are affected. Review whether Creator-role users can create integrations using the copy-from workflow and whether private database integrations exist.