# CVE-2026-121736: NocoDB missing authentication in OAuth authorize handler

Source: https://junglewise.ai/threats/cve-2026-121736-nocodb-0-300-0-before-2026-08-0-contains-a-missing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-121736 · Severity: medium · CVSS 5.3 · Published 2026-11-03

NocoDB is a self-hosted Airtable alternative that allows users to build databases and APIs without code. A missing authentication vulnerability in the OAuth authorization endpoint allows unauthenticated attackers to create authorization codes without user approval, potentially enabling unauthorized access to connected applications and user data.

Technologies: [NocoDB](https://junglewise.ai/threats/technologies/nocodb-nocodb). Vendors: [NocoDB](https://junglewise.ai/threats/vendors/nocodb).

## Quick answers

**Is CVE-2026-121736 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121736 being exploited in the wild.

**How severe is CVE-2026-121736?** Medium severity, with a CVSS score of 5.3, published 3 November 2026.

**Which products and versions are affected?** NocoDB 0.300.0 to before 2026.08.0.

**Is there a fix for CVE-2026-121736?** Yes: fixed in NocoDB 2026.08.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121736 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-121736?** Check whether you run NocoDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in NocoDB 2026.08.0

## Technical details

The POST /api/v2/oauth/authorize endpoint lacks authentication checks, permitting unauthenticated requests with client_id, redirect_uri, and approved=true parameters to generate valid authorization codes. Attackers can create unbounded ownerless authorization code records limited only by rate limiting, bypassing the OAuth approval flow. A fix is available in version 2026.08.0 and later.

## Affected products

- NocoDB NocoDB 0.300.0 to before 2026.08.0

## Timeline

- 2026-11-03: disclosed

## References

- [https://github.com/nocodb/nocodb](https://github.com/nocodb/nocodb)
- [https://github.com/nocodb/nocodb/blob/2026.07.0/packages/nocodb/src/modules/oauth/controllers/oauth.controller.ts](https://github.com/nocodb/nocodb/blob/2026.07.0/packages/nocodb/src/modules/oauth/controllers/oauth.controller.ts)

## Related threats

- [NocoDB clickjacking vulnerability in authenticated interface](https://junglewise.ai/threats/cve-2026-119715-nocodb-before-2026-08-0-contains-a-clickjacking-vulnerability)
- [NocoDB resource exhaustion in authentication endpoints](https://junglewise.ai/threats/cve-2026-116120-a-vulnerability-was-determined-in-nocodb-up-to-2026-07-0-this)
- [NocoDB race condition in password-reset flow](https://junglewise.ai/threats/cve-2026-116119-a-vulnerability-was-found-in-nocodb-up-to-2026-08-0-this-affects)
- [NocoDB serverRequest Server-Side Request Forgery](https://junglewise.ai/threats/cve-2026-88403-a-server-side-request-forgery-ssrf-in-the-serverrequest-function)