NocoBase plugin-ai 2.1.0 through 2.2.41 Authorization Bypass via Sub-Agent Username Override
NocoBase plugin-ai versions 2.1.0 through 2.2.41 let authenticated users reach AI employees not assigned to their roles. No vendor rating is given, and no fixed version is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fix or patch referenced
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. NocoBase plugin-ai versions 2.1.0 through 2.2.41 are affected. The attacker must be an authenticated user; the bug is reached via the dispatch-sub-agent-task or get-ai-employee tools.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 15/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run ungranted AI employees with their tools and permissions, and get-ai-employee to read their prompts and tool configuration.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.1/10CVSS 7.1
- No patch0/5No signal
What would change the score
- Would score about 65 if added to CISA KEV
- Would score about 60 if CISA's SSVC rates exploitation active
- Would score about 22 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
NocoBase plugin-ai versions 2.1.0 through 2.2.41 are affected. The attacker must be an authenticated user; the bug is reached via the dispatch-sub-agent-task or get-ai-employee tools.Apply the patch listed under Evidence.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- nocobase nocobase
From 2.1.0 · through 2.2.41
Evidence 5
- Patch
- Patch
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-125397
Is CVE-2026-125397 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
An authenticated user can reach AI employees that were not granted to their roles. Through the affected tools, such a user can run those employees with their tools and permissions and read their prompts and tool configuration.Source: vulncheck.com
Which versions are affected by CVE-2026-125397?
nocobase: from 2.1.0 through 2.2.41.Source: cve.now feed data
Am I affected, and how do I check?
NocoBase plugin-ai versions 2.1.0 through 2.2.41 are affected. The bug is reached through the dispatch-sub-agent-task or get-ai-employee tools, so checking whether the plugin-ai version falls in that range is the way to see if a deployment is in scope.Source: vulncheck.com
How do I fix CVE-2026-125397?
No fixed version is listed in the checked facts, so the upgrade target is not confirmed. Check the NocoBase advisory for a patched release beyond 2.2.41 before changing anything.Source: vulncheck.com