NocoDB Sign-in Endpoint AuthService.validateUser information disclosure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
NocoDB, an open-source platform for building databases and spreadsheet-style apps, has a flaw in its sign-in process that can leak sensitive information to remote attackers. Exploiting it is considered difficult, and the vendor has not responded to disclosure attempts.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is considered difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- n/a NocoDB
2026.07