# CVE-2026-125397: NocoBase plugin-ai authorization bypass in getAccessibleAIEmployee()

Source: https://junglewise.ai/threats/cve-2026-125397-nocobase-plugin-ai-2-1-0-through-2-2-41-contains-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125397 · Severity: high · CVSS 7.1 · Published 2026-11-10

NocoBase plugin-ai is a component that manages AI employee agents within the NocoBase business system platform. An authenticated user can bypass authorization checks to access AI employees they are not assigned to, potentially running ungranted tools and reading sensitive prompts and configurations. This allows attackers to escalate privileges and access restricted AI capabilities within their organization.

Vendors: [NocoBase](https://junglewise.ai/threats/vendors/nocobase).

## Quick answers

**Is CVE-2026-125397 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125397 being exploited in the wild.

**How severe is CVE-2026-125397?** High severity, with a CVSS score of 7.1, published 10 November 2026.

**Which products and versions are affected?** NocoBase Plugin-Ai 2.1.0 through 2.2.41.

**Is there a fix for CVE-2026-125397?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-125397 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-125397?** Check whether you run NocoBase Plugin-Ai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The getAccessibleAIEmployee() function fails to properly enforce role-based access control, allowing authenticated users to override the role-derived filter by supplying an arbitrary username parameter. Attackers can abuse the dispatch-sub-agent-task tool to execute ungranted AI employees with their associated tools and permissions, or use get-ai-employee to read protected prompts and tool configurations. Authentication is required but no additional preconditions exist.

## Affected products

- NocoBase plugin-ai 2.1.0 through 2.2.41

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/nocobase/nocobase](https://github.com/nocobase/nocobase)
- [https://github.com/nocobase/nocobase/blob/v2.2.41/packages/plugins/@nocobase/plugin-ai/src/ai/tools/sub-agents/shared.ts](https://github.com/nocobase/nocobase/blob/v2.2.41/packages/plugins/@nocobase/plugin-ai/src/ai/tools/sub-agents/shared.ts)