| 제목 | nocodb <=2026.07.0 Allocation of Resources Without Limits or Throttling |
|---|
| 설명 | PublicApiLimiterGuard is the only guard applied to the unauthenticated registration and password-reset endpoints, and it returns true unconditionally. No ThrottlerGuard is bound at the application level either. As a result:
POST /auth/user/signup accepts unlimited account creation. Each successful call inserts a row into nc_users_v2 and dispatches a WELCOME mail through MailService.
POST /auth/password/forgot accepts unlimited requests for any address. Each call for a registered address writes a fresh reset token to the user row, invalidates all of that user's refresh tokens and OAuth tokens, and dispatches a RESET_PASSWORD mail.
An unauthenticated attacker can therefore create accounts and cause outbound mail to arbitrary third-party addresses at full network speed, using the target's mail infrastructure and sender reputation.
The passwordForgot path carries an additional consequence that is not merely a nuisance: every request for a registered address executes UserRefreshToken.deleteAllUserToken() and revokeAllOAuthTokensByUser(). An attacker who repeatedly requests password resets for a known address continuously terminates that user's active sessions, denying them persistent access without any credential knowledge.
The guard's source comment states that rate limiting is intentionally deferred to the network layer (reverse proxy, load balancer, WAF, API gateway). That is a defensible architectural position, but it leaves default self-hosted deployments — which ship no such layer — with no protection on these endpoints. |
|---|
| 원천 | ⚠️ https://github.com/nocodb/nocodb/issues/14685 |
|---|
| 사용자 | ZAST.AI (UID 87884) |
|---|
| 제출 | 2026. 09. 29. AM 10:48 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 25. AM 10:23 (26 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 426188 [NocoDB 까지 2026.07.0 PublicApiLimiterGuard /auth/user/signup UserRefreshToken.deleteAllUserToken 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|