CVE-2026-126281
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own.