CVE-2026-126273
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control.