CVE-2026-53926— NocoDB: OAuth Tokens Persist Through Security Events
Quick assessment
Affected
nocodb nocodb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NocoDB是nocodb公司开源的一个 Airtable 替代品。将任何 MySql、PostgreSql、Sql Server、Sqlite 和 MariaDb 转换为智能电子表格。 NocoDB 2026.05.1之前版本存在会话机制问题漏洞，该漏洞源于密码变更、重置或恢复时revokeAllOAuthTokensByUser函数为空桩，OAuth访问和刷新令牌未被撤销，可能导致攻击者颁发的OAuth授权在用户认为已锁定攻击者后仍然有效。
Possible ATT&CK Techniques 1 AI
T1136.002 · Domain Account
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-53926
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NocoDB: OAuth Tokens Persist Through Security Events
Source: CVE Program / CVE List V5
Vulnerability Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called from passwordChange, passwordForgot, and passwordReset. OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password, leaving an attacker-issued OAuth grant valid after the user believed they had locked the attacker out. This vulnerability is fixed in 2026.05.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Vulnerability Title
NocoDB 会话机制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NocoDB是nocodb公司开源的一个 Airtable 替代品。将任何 MySql、PostgreSql、Sql Server、Sqlite 和 MariaDb 转换为智能电子表格。 NocoDB 2026.05.1之前版本存在会话机制问题漏洞，该漏洞源于密码变更、重置或恢复时revokeAllOAuthTokensByUser函数为空桩，OAuth访问和刷新令牌未被撤销，可能导致攻击者颁发的OAuth授权在用户认为已锁定攻击者后仍然有效。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-53926
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53926
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-53926 (1)
Same Patch Batch · nocodb · 2026-06-23 · 29 CVEs total
| CVE-2026-46551 | 6.5 MEDIUM | NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk E |
| CVE-2026-46547 | 6.1 MEDIUM | NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL |
| CVE-2026-47375 | 6.0 MEDIUM | NocoDB: Postgres SQL Injection in Formula `ARRAYSORT` |
| CVE-2026-46552 | 5.8 MEDIUM | NocoDB: Shared-base link access can invite arbitrary users as persistent base members |
| CVE-2026-46550 | 5.4 MEDIUM | NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags |
| CVE-2026-46548 | 4.3 MEDIUM | NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost |
| CVE-2026-46549 | 2.0 LOW | NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation |
| CVE-2026-47386 | NocoDB: OAuth Authorization Code Race Condition | |
| CVE-2026-46553 | NocoDB: Attachment Size Limit Bypass via Upload-by-URL | |
| CVE-2026-46554 | NocoDB: Stale Auth Cache After API Token Deletion | |
| CVE-2026-47385 | NocoDB: Path Traversal via SQLite Source Filename | |
| CVE-2026-47382 | NocoDB: Server-Side Request Forgery via Database Connection Host | |
| CVE-2026-47376 | NocoDB: Reflected Cross-Site Scripting via Password Reset Token | |
| CVE-2026-47384 | NocoDB: SQL Injection via Column Title in Bulk GroupBy | |
| CVE-2026-53929 | NocoDB: Stored Cross-Site Scripting via Secure Attachment | |
| CVE-2026-47377 | NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin | |
| CVE-2026-47381 | NocoDB: Cross-Workspace Integration Use in Connection Test | |
| CVE-2026-47378 | NocoDB: Hidden Column Exposure in Public Shared View Endpoints | |
| CVE-2026-47379 | NocoDB: Plaintext Password Comparison in Shared Views | |
| CVE-2026-47388 | NocoDB: Missing Ownership Check in MCP Attachment Read |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: nocodb
-
CVE-2026-46547
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redi -
CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugi -
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows S -
CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `Secure` and `SameS -
CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users a
Same vendor: nocodb
-
CVE-2026-46547
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redi -
CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugi -
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows S -
CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `Secure` and `SameS -
CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users a
Same weakness: CWE-613
-
CVE-2026-79664
Ech0 before 4.7.3 Access Token Revocation Bypass -
CVE-2026-77130
Insufficient Session Expiration in extension "SYSSY - TYPO3 -
CVE-2026-75554
Explicit organization scopes survive token refresh after mem -
CVE-2026-14950
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnera -
CVE-2026-65984
FUXA: JWT lifecycle flaws allow deleted or demoted users to
V. Comments for CVE-2026-53926
No comments yet