Executive brief
NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw allowed stolen login credentials (refresh tokens) to remain valid even after a user reset their password using the "Forgot Password" feature. This means an attacker who previously gained access to a user's session could maintain that access indefinitely, even if the victim attempted to secure their account by changing their password.
Technical details
NocoDB prior to version 2026.05.1 contains a session management vulnerability (CWE-613) where the 'passwordForgot' flow fails to revoke existing refresh tokens. While 'passwordChange' and 'passwordReset' correctly call 'UserRefreshToken.deleteAllUserToken(user.id)', the 'passwordForgot' logic only rotates the 'token_version' and revokes OAuth tokens. Consequently, an attacker possessing a captured refresh cookie can continue to mint new JWT access tokens even after the victim completes the recovery process. This issue is resolved in version 2026.05.1 by ensuring all user tokens are deleted during the recovery flow.
Affected products
- NocoDB NocoDB < 2026.05.1
Timeline
- 2026-06-13: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD