CVE-2026-121736 NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-121736?
CVE-2026-121736 is a medium-severity vulnerability in nocodb, published on 3 Nov 2026.
Official description
NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_id, redirect_uri and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting.
Weakness: CWE-306
Which versions are affected by CVE-2026-121736?
How do I fix CVE-2026-121736?
No fix has been published for CVE-2026-121736 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-121736 being exploited?
There is no known exploitation of CVE-2026-121736 in the wild and no public exploit code.
Sources
Also known as GHSA-532v-ccph-m3xg, GHSA-mc8q-8prc-j4hf.