Is CVE-2026-53926 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53926 being exploited in the wild.

How severe is CVE-2026-53926?

Medium severity, with a CVSS score of 4, published 23 June 2026.

Which products and versions are affected?

nocodb (npm) ECOSYSTEM:introduced=0,fixed=2026.05.1.

Is there a fix for CVE-2026-53926?

Yes. nocodb (npm): upgrade to 2026.05.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53926 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-53926?

Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53926: NocoDB insufficient session expiration in OAuth token revocation

CVE-2026-53926 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB, a platform for building databases as spreadsheets, failed to properly cancel active login sessions when a user changed or reset their password. This means that if an attacker had already gained access to an account via an OAuth token, they would remain logged in even after the legitimate user updated their security credentials. This could lead to unauthorized data access and persistent account compromise despite the user's attempts to secure their account.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-53926 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53926 being exploited in the wild.
How severe is CVE-2026-53926?: Medium severity, with a CVSS score of 4, published 23 June 2026.
Which products and versions are affected?: nocodb (npm) ECOSYSTEM:introduced=0,fixed=2026.05.1.
Is there a fix for CVE-2026-53926?: Yes. nocodb (npm): upgrade to 2026.05.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53926 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-53926?: Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nocodb (npm): upgrade to 2026.05.1 or later
```
npm install nocodb@2026.05.1
```

Technical details

A vulnerability exists in NocoDB where the 'revokeAllOAuthTokensByUser' function in the users service was implemented as an empty stub. Consequently, when security events such as passwordChange, passwordForgot, or passwordReset were triggered, existing OAuth access and refresh tokens remained valid. An attacker with a previously issued OAuth grant could maintain persistent access to the user's account even after a password reset. The fix, introduced in version 2026.05.1, implements proper delegation to 'OAuthToken.revokeAllByUser' to delete relevant database rows and invalidate authentication caches.

Affected products

nocodb nocodb < 2026.05.1

Identifiers

CVE-2026-53926
GHSA-g72g-r7m4-9x4g

Timeline

2026-06-04: advisory: GitHub Security Advisory published
2026-06-23: disclosed: CVE published to NVD

References

https://github.com/nocodb/nocodb/security/advisories/GHSA-g72g-r7m4-9x4g

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.