GHSA-532v-ccph-m3xg: NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation
NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with clientid, redirecturi and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting.
Event History
Frequently Asked Questions
Who is exposed to this issue?
NocoDB deployments running version 0.300.0 through versions before 2026.08.0 are affected if the POST /api/v2/oauth/authorize endpoint is reachable. Exploitation does not require authentication.
What does an attacker need to send to exploit it?
An attacker can send anonymous POST requests to /api/v2/oauth/authorize containing client_id, redirect_uri, and approved=true. This creates ownerless OAuth authorization-code records.
What is the practical impact?
An attacker can create an unbounded number of ownerless authorization-code records. The only stated constraint is rate limiting.
How can I check whether my deployment may already have been targeted?
Review records for OAuth authorization codes without an owner, and inspect requests to POST /api/v2/oauth/authorize for anonymous submissions containing approved=true. The available data does not identify a more specific indicator of compromise.