Is CVE-2026-121736 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121736 being exploited in the wild.

How severe is CVE-2026-121736?

Medium severity, with a CVSS score of 5.3, published 3 November 2026.

Which products and versions are affected?

NocoDB 0.300.0 to before 2026.08.0.

Is there a fix for CVE-2026-121736?

Yes: fixed in NocoDB 2026.08.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121736 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-121736?

Check whether you run NocoDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121736: NocoDB missing authentication in OAuth authorize handler

CVE-2026-121736 · Severity: medium · CVSS 5.3 · Published 2026-11-03

NocoDB is a self-hosted Airtable alternative that allows users to build databases and APIs without code. A missing authentication vulnerability in the OAuth authorization endpoint allows unauthenticated attackers to create authorization codes without user approval, potentially enabling unauthorized access to connected applications and user data.

Technologies: NocoDB. Vendors: NocoDB.

Quick answers

Is CVE-2026-121736 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121736 being exploited in the wild.
How severe is CVE-2026-121736?: Medium severity, with a CVSS score of 5.3, published 3 November 2026.
Which products and versions are affected?: NocoDB 0.300.0 to before 2026.08.0.
Is there a fix for CVE-2026-121736?: Yes: fixed in NocoDB 2026.08.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121736 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-121736?: Check whether you run NocoDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: NocoDB 2026.08.0

Technical details

The POST /api/v2/oauth/authorize endpoint lacks authentication checks, permitting unauthenticated requests with client_id, redirect_uri, and approved=true parameters to generate valid authorization codes. Attackers can create unbounded ownerless authorization code records limited only by rate limiting, bypassing the OAuth approval flow. A fix is available in version 2026.08.0 and later.

Affected products

NocoDB NocoDB 0.300.0 to before 2026.08.0

Timeline

2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.