Executive brief
NocoDB, a platform that turns databases into smart spreadsheets, suffered from a flaw where deleted API access tokens remained active for up to three days. This means that even after an administrator revoked a user's or application's access, that token could still be used to view or modify data until the system's internal memory refreshed. This could lead to unauthorized data access during the window between token deletion and actual expiration.
Technical details
A vulnerability in NocoDB's authentication middleware (CWE-613) resulted in insufficient session expiration for API tokens. While the token deletion process successfully removed the corresponding record from the database, it failed to evict the token-value keyed entry from the authentication cache. Consequently, the middleware continued to validate requests using the deleted token until the cache entry reached its Time-To-Live (TTL) limit, which could be as long as 72 hours. This issue is resolved in version 2026.04.4 by ensuring the cache is properly invalidated upon token deletion.
Affected products
- nocodb nocodb < 2026.04.4
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD