GHSA-mmvm-m83w-6684: NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints
NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory.
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with Editor write permission on a single table can exploit it. No higher administrative privilege or user interaction is required.
Are API-token clients affected in the same way as session-authenticated users?
The bypass is specifically achieved by using session authentication instead of API tokens. Bulk row-count limits can therefore be bypassed through session-authenticated requests to the affected bulk write routes.
What impact should operators expect from exploitation?
An attacker can submit hundreds of thousands of rows through v1 or v2 bulk write routes, exhausting database connections, CPU, and memory. This can cause an availability impact.
Which versions need remediation?
NocoDB versions before 2026.09.0 are affected. Upgrading to 2026.09.0 or later addresses the stated affected version range.