CVE-2026-116120— NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources

Quick assessment

Affected

n/a NocoDB

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

经确认，NocoDB 在 2026.07.0 及更早版本中存在一个漏洞。该漏洞位于组件 PublicApiLimiterGuard 的文件中，具体影响函数。攻击者可通过操纵该函数导致资源分配异常。此攻击可远程实施，复杂度较高，且利用难度较大。经代码验证，未认证的注册（signup）和密码找回（password-forgot）接口缺乏应用层速率限制，同时每个请求均会触发刷新令牌（refresh token）和 OAuth 令牌的无效化操作。然而，供应商在文档中将“透传限制器”（pass-through limi

CVSS 5.6 · Medium Updated Oct 26, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllUserToken of the file /auth/user/signup of the component PublicApiLimiterGuard. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The attack is considered to have high complexity. It is stated that the exploitability is difficult. Code-verified absence of in-app rate limiting on the unauthenticated signup and password-forgot endpoints and per-request refresh/OAuth token invalidation, but the vendor documents the pass-through limiter as intentional design. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	NocoDB	2026.07	`cpe:2.3:a:nocodb:nocodb::::::::`

II. Public POCs for CVE-2026-116120

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116120

请登录查看更多情报信息。

Other References for CVE-2026-116120 (5)

https://github.com/nocodb/nocodb/issues/14685 issue-tracking
https://github.com/nocodb/nocodb/ product
https://vuldb.com/cve/CVE-2026-116120 third-party-advisory
https://vuldb.com/vuln/426188/cti signature permissions-required
https://vuldb.com/submit/1004892 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116120

Same Patch Batch · n/a · 2026-10-26 · 9 CVEs total

CVE-2026-116106	7.3 HIGH	HeyCyan App FileProvider access control
CVE-2026-116113	6.3 MEDIUM	GouGuOA Api.php chunkUpload unrestricted upload
CVE-2026-116119	5.5 MEDIUM	NocoDB Password-Reset Flow users.service.ts race condition
CVE-2026-116123	3.7 LOW	NocoDB signup validatePassword excessive authentication
CVE-2026-116122	3.7 LOW	NocoDB Sign-in Endpoint AuthService.validateUser information disclosure
CVE-2026-116121	3.7 LOW	NocoDB Registration users.service.ts race condition
CVE-2026-116105	3.7 LOW	HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission
CVE-2026-116100	2.4 LOW	gougucms User Level Level.php add cross site scripting

IV. Related Vulnerabilities

Same product: NocoDB

Same vendor: n/a

Same weakness: CWE-770