CVE-2026-126293
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understates or omits its length to exhaust disk space or storage quota.