CVE-2026-126270
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load.