CVE-2026-121736— NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation

Quick assessment

Affected

nocodb nocodb

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NocoDB 0.300.0 至 2026.08.0 之前的版本中，POST /api/v2/oauth/authorize 处理程序存在身份验证缺失漏洞，允许未经身份验证的攻击者创建 OAuth 授权码。攻击者可发送包含 client_id、redirect_uri 和 approved=true 的匿名请求，从而插入无限制且无所属用户的授权码记录，仅受速率限制约束。

CVSS 5.3 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation

Source: CVE Program / CVE List V5

Vulnerability Description

NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_id, redirect_uri and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nocodb	nocodb	0.300.0 ~ 2026.08.0	-

II. Public POCs for CVE-2026-121736

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121736

请登录查看更多情报信息。

Vendor Pages for CVE-2026-121736 (2)

Other References for CVE-2026-121736 (4)

https://github.com/nocodb/nocodb/blob/2026.07.0/packages/nocodb/src/modules/oauth/controllers/oauth.controller.ts#L56-L92 technical-description
https://github.com/nocodb/nocodb/commit/42128735eba328d157c2e90b98795cb248dc0847 patch
https://github.com/nocodb/nocodb/security/advisories/GHSA-532v-ccph-m3xg vendor-advisory
https://www.vulncheck.com/advisories/nocodb-0.300.0-before-2026.08.0-unauthenticated-oauth-authorization-code-creation third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121736

IV. Related Vulnerabilities

Same product: nocodb

Same vendor: nocodb

Same weakness: CWE-306