CVE-2026-126283
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base the token owner belongs to, including bases joined later.