HIGHCVSS v3.1 7.7Vulnerability
CVE-2026-126285
NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.00379
- Cvss severity
- HIGH
- Cvss score
- 7.7
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Last source
- FIRST EPSS
- Score
- 7.7
- Cvss version
- 3.1
- Cve id
- CVE-2026-126285
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- First seen by Signal
- 2026-11-13T17:31:47+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Published at
- 2026-11-13T10:17:32.140
- Last modified
- 2026-11-13T10:17:32.140
- Epss percentile
- 0.32433
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph