MEDIUMCVSS v3.1 6.5Vulnerability
CVE-2026-126281
NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.00354
- Cvss severity
- MEDIUM
- Cvss score
- 6.5
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Last source
- FIRST EPSS
- Score
- 6.5
- Cvss version
- 3.1
- Cve id
- CVE-2026-126281
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- First seen by Signal
- 2026-11-13T17:31:47+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Published at
- 2026-11-13T10:17:31.517
- Last modified
- 2026-11-13T10:17:31.517
- Epss percentile
- 0.29527
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph