PT-2026-42679 · Nocodb · Nocodb

Published 2026-05-21 · Updated 2026-05-21 · CVE-2026-46553

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions NocoDB (affected versions not specified)

Description An issue exists where the upload-by-URL path fails to enforce the NC ATTACHMENT FIELD SIZE limit against the remote file's advertised Content-Length or the decoded length of a data: URI. This allows authenticated users with upload permissions to bypass configured per-file size limits, potentially exceeding storage and bandwidth caps.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-46553

GHSA-8RWR-F68V-CVW6

Affected Products

Nocodb

References · 4

• https://osv.dev/vulnerability/GHSA-8rwr-f68v-cvw6 · Vendor Advisory
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/security/advisories/GHSA-8rwr-f68v-cvw6 · Note
• https://twitter.com/dailycve/status/2057604912767238564 · Twitter Post