CVE-2026-126291: NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query
NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a single quote to execute arbitrary SQL, exposing user records, API tokens and data-source credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.06.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be a registered NocoDB user and able to set their email address to a quoted local part containing a single quote. No user interaction is required after that.
What information could be exposed or modified through exploitation?
Successful exploitation can execute arbitrary SQL. The stated impact includes exposure of user records, API tokens, and data-source credentials, with high confidentiality, integrity, and availability impact.
Which deployments are affected?
NocoDB versions before 2026.06.2 are affected. The issue occurs when queries resolve user, created-by, or last-modified-by fields and concatenate base-member email addresses into SQL text.