VulnSocial

CVE-2026-24766Disclosure(nocodb / nocodb)

LOWCVSS 4.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator permissions can exploit prototype pollution in the `/api/v2/meta/connection/test` endpoint, causing all database write operations to fail application-wide until server restart. While the pollution technically bypasses SUPER_ADMIN authorization checks, no practical privileged actions can be performed because database operations fail immediately after pollution. Version 0.301.0 patches the issue.

nocodb CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-1321

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • nocodb

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-01-28); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
nocodb
Products
nocodb

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-01-28: 1Mentions · 2026-01-29: 1Technical Details · 2026-01-28: 1Technical Details · 2026-01-29: 101-2801-29
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • cvereports@_cvereports
    Disclosure

    CVE-2026-24766: NocoDB Prototype Pollution: Crashing the Database Party with One JSON Key A classic Prototype Pollution vulnerability exists in NocoDB's connection testing endpoint. By supplying a crafted JSON payload containing the `__proto__` key, a... https://cvereports.com/reports/CVE-2026-24766

    Post summary

    The report highlights a prototype‑pollution flaw in NocoDB’s connection testing endpoint that can be provoked with a crafted JSON payload containing the `__proto__` key, potentially causing database crashes.

    0102093
    29 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-24766 Prototype Pollution Vulnerability in NocoDB Prior to 0.301.0 Causing Database Write Failures https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24766

    Post summary

    The text announces a prototype‑pollution vulnerability in NocoDB versions before 0.301.0 that leads to database write failures, without mentioning PoC, exploits, patches, or active exploitation.

    1000086
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appnocodbnocodb---

Explore more

Back to dashboardnocodb CVEsnocodb vulnerabilities