NocoDB Registration users.service.ts race condition
Impact
NocoDB up to version 2026.08.0 has a race condition vulnerability in the Registration component's users.service.ts file, which can be exploited remotely with high complexity. The impact is unclear. The vendor has not responded to disclosure attempts.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.The attack requires a high level of complexity.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
n/a · VulDB
NocoDB
1 range
n/a · VulDB
NocoDB
Compare with this publisher’s ranges. This does not inspect your installation.
affected
2026.08
Other versions: unknown
Product identifiers (CPE)
cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*Original source description
A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-116121View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.