Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-53926

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called from passwordChange, passwordForgot, and passwordReset. OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password, leaving an attacker-issued OAuth grant valid after the user believed they had locked the attacker out. This vulnerability is fixed in 2026.05.1.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:d3bc526e4992b467909d0d1dfb84235974bb62b3210aa378ad15e2ea57948d28
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"nocodb","vendor":"nocodb","versions":[{"status":"affected","version":"< 2026.05.1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:93005dabf893e8903848a34b8c33ef82d1aba0c71b5d5982dc71a2b7a8e583b1 · sha256:7214ed57c0832ffb… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":6.3,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:93005dabf893e8903848a34b8c33ef82d1aba0c71b5d5982dc71a2b7a8e583b1 · sha256:7214ed57c0832ffb… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-613","description":"CWE-613: Insufficient Session Expiration","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:93005dabf893e8903848a34b8c33ef82d1aba0c71b5d5982dc71a2b7a8e583b1 · sha256:7214ed57c0832ffb… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"name":"https://github.com/nocodb/nocodb/security/advisories/GHSA-g72g-r7m4-9x4g","tags":["x_refsource_CONFIRM"],"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-g72g-r7m4-9x4g"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:93005dabf893e8903848a34b8c33ef82d1aba0c71b5d5982dc71a2b7a8e583b1 · sha256:7214ed57c0832ffb… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer