CVE-2026-121736 in NocoDB
Summary
by MITRE • 11/04/2026
NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_id, redirect_uri and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The identified vulnerability in NocoDB versions prior to 2026.08.0 represents a critical failure in access control mechanisms within the OAuth authentication flow. Specifically, the POST /api/v2/oauth/authorize endpoint lacks proper validation of user session state or token presence before processing authorization requests. This architectural flaw allows unauthenticated actors to interact with the core identity management subsystem without presenting valid credentials or active sessions. The vulnerability stems from an incomplete implementation of the OpenID Connect and OAuth 2.0 standards, where the server fails to enforce mandatory authentication checks at a critical juncture in the token issuance lifecycle. By bypassing these controls, external entities can manipulate the authorization code generation process, effectively impersonating legitimate users or creating fraudulent trust relationships with connected applications.
From a technical perspective, the exploitation vector involves sending HTTP POST requests containing specific parameters such as client_id, redirect_uri, and approved=true without any accompanying authentication headers or session cookies. The application logic incorrectly interprets these anonymous inputs as valid authorization grants, resulting in the creation of OAuth authorization codes that are not bound to any legitimate user account. These records exist within the database with no associated owner, creating orphaned entries that can be leveraged for further malicious activities. While rate limiting provides a partial mitigation against high-volume automated attacks, it does not address the fundamental logic error allowing unauthenticated access. The ability to generate these codes is limited only by the configured rate limits, meaning determined attackers can still produce sufficient authorization tokens to conduct targeted attacks or disrupt service availability through resource exhaustion.
The operational impact of this vulnerability extends beyond simple unauthorized data creation. Attackers possessing valid OAuth client credentials from a third-party application integrated with NocoDB could potentially use these forged authorization codes to obtain access tokens if the token endpoint also suffers from similar validation weaknesses, although the primary issue here is the generation phase. More immediately, the accumulation of unbounded ownerless records can lead to database bloat and performance degradation over time. Furthermore, in environments where OAuth flows are used for single sign-on or API integration with external services, these unauthorized codes could be intercepted if redirect URIs are misconfigured or vulnerable to open redirects, potentially leading to credential theft or session hijacking scenarios depending on the specific deployment context. This flaw undermines the integrity of the authentication framework and compromises trust in user identity assertions within the platform.
This vulnerability aligns with CWE-287 Improper Authentication, as the system fails to correctly verify the identity of a user prior to granting access privileges associated with OAuth authorization codes. It also relates to CWE-613 Insufficient Session Expiration, given that these unauthorized sessions or tokens may persist if not properly invalidated by subsequent security controls. In terms of offensive security frameworks, this behavior is consistent with MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate authentication mechanisms in an unintended manner to gain foothold or escalate privileges. The lack of strict session validation during the authorization step allows for abuse of trusted protocols, facilitating potential lateral movement if integrated systems are compromised via these forged tokens.
To mitigate this risk, immediate action is required by upgrading NocoDB to version 2026.08.0 or later where the authentication checks on the /api/v2/oauth/authorize endpoint have been corrected. Administrators should ensure that all OAuth clients are configured with strict redirect URI validation to prevent code interception attacks even if authorization codes are generated maliciously. Implementing additional rate limiting specifically for unauthenticated requests to this endpoint can further reduce the attack surface while patches are applied. Security teams should also audit logs for unusual spikes in POST requests to the oauth/authorize path, particularly those lacking standard authentication headers, as these may indicate active exploitation attempts. Regular penetration testing focusing on identity and access management flows is recommended to identify similar logic flaws in other endpoints before they can be exploited by adversaries.