PT-2026-22632 · Nocodb · Nocodb

Bugbunny-Research · Published 2026-03-02 · Updated 2026-03-02 · CVE-2026-28361

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.3

Description NocoDB is software for building databases as spreadsheets. The MCP token service did not validate token ownership. This allowed a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known. The issue affects versions prior to 0.301.3.

Recommendations Update to version 0.301.3 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-28361

GHSA-P9X3-W98F-7J3Q

Affected Products

Nocodb

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28361.json · Exploit
• https://github.com/nocodb/nocodb/security/advisories/GHSA-p9x3-w98f-7j3q · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9x3-w98f-7j3q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28361 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28361 · Vendor Advisory
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/releases/tag/0.301.3 · Note
• https://reddit.com/r/VulnMatter/comments/1rj3cki/resumen_diario_de_vulnerabilidades_02032026 · Reddit Post
• https://t.me/CVEtracker/46140 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2028616998440067205 · Twitter Post
• https://twitter.com/CVEnew/status/2028510367328944325 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028512164269392033 · Twitter Post