CVE-2026-126283: NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens
NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's baseid is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base the token owner belongs to, including bases joined later.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances running NocoDB before 2026.08.0 are affected where base-scoped API tokens exist. The impact applies to every base that the token owner belongs to, including bases the owner joins after the token was created.
What does an attacker need to exploit it?
An attacker needs possession of a leaked base-scoped API token. No user interaction is required, and the token can then be used beyond its intended base scope.
What can an attacker do with a leaked token?
The attacker can read, write, and delete records across every base accessible to the token owner. This can affect confidentiality, integrity, and availability of data in those bases.
How can I tell whether I may already be affected?
Review whether any base-scoped API tokens have been exposed or leaked and identify all bases their owners can access. Because access includes bases joined later, review the owners' current base memberships as well as the token's originally intended base.