Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| nocodb | nocodb | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 13 Nov 2026 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking. | |
| Title | NocoDB before 2026.06.1 Password Hash Exposure via Profile Update Response | |
| First Time appeared |
Nocodb
Nocodb nocodb |
|
| Weaknesses | CWE-200 | |
| CPEs | cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Nocodb
Nocodb nocodb |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-13T09:36:31.185Z
Reserved: 2026-11-10T20:15:03.179Z
Link: CVE-2026-126292
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-13T10:17:33.590
Modified: 2026-11-13T10:17:33.590
Link: CVE-2026-126292
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor