CVE-2026-126290: NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read
NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NocoDBto a version that resolves this vulnerability.Fixed in 2026.07.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who is a member of a NocoDB base can exploit it. The issue allows that member to target private integrations belonging to another user in the same base.
What access and request conditions are required?
The attacker needs authenticated base-member access and must request another user's private integration while omitting the configuration query flag. No user interaction is required.
What information could be exposed?
Stored connection credentials from private integration configurations may be disclosed. The vulnerability affects NocoDB versions before 2026.07.0.