CVE-2026-126282: NocoDB from 2026.04.0 before 2026.08.0 Improper Privilege Management via Organization Role Update
NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read, write and schema modification access across all default-workspace bases using their existing session token.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.08.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
NocoDB deployments running versions from 2026.04.0 before 2026.08.0 are affected. The impact applies to users whose legacy organization role is updated after they have been revoked, because the update can rewrite their role in the default workspace.
What does an attacker need to exploit it?
The attacker needs a previously revoked user account with an existing session token, and a legacy organization-role update must occur for that user. User interaction is required according to the supplied vector.
What access can a revoked user regain?
A revoked user can silently regain Creator-level access across all bases in the default workspace. This includes read, write, and schema-modification permissions.
How can administrators identify possible exposure?
Review whether a revoked user's legacy organization role was updated while that user retained an existing session token. Such users may have regained Creator-level permissions in the default workspace despite having been revoked.