CVE Alert: CVE-2026-126280 – nocodb

NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded.

**Risk verdict:** Treat as high priority for internet-reachable deployments, but urgency cannot be calibrated further because exploitation-status and probability data were not supplied.

**Why this matters:** A stolen refresh token could be turned into a usable session, enabling access to sensitive workspace data and changes made as the account. The attacker must already possess a token, so token theft or leakage is a key part of the realistic threat.

**Most likely attack path:** The endpoint is network-accessible, requires no prior application privileges or user interaction, but exploitation depends on a difficult timing race and a captured token. An attacker would send concurrent refresh requests while the legitimate user is refreshing; successful reuse may evade expected reuse records. Scope is unchanged, so this does not by itself establish a route into other security domains, though the compromised account’s permissions may enable further actions.

**Who is most exposed:** Prioritise self-hosted, internet-facing low-code database and spreadsheet-style platforms, especially those with many users or sensitive records.

Alert on concurrent refresh requests using the same token or account.

Look for overlapping sessions or unusual session creation after refresh.

Review authentication logs for refresh activity without corresponding reuse events.

Check for unexpected data exports or edits by affected accounts.

Mitigation and prioritisation:

Upgrade promptly to the vendor-fixed release; validate the deployed build.

Revoke active refresh tokens and require re-authentication where feasible.

Restrict access to the service to trusted networks pending remediation.

Review deployment and change logs; no KEV, SSVC, PoC or EPSS evidence was supplied, leaving active exploitation uncertain.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.