Vulnerability · Published Oct 26, 2026 · Assigned by VulDB

CVE-2026-116121NocoDB Registration users.service.ts race condition

Low 3.7

In plain English

A low-severity race condition in NocoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.2%top 86.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	NocoDB	2026.08

Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C

References

VDB-426189 | NocoDB Registration users.service.ts race condition vdb-entry
VDB-426189 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-116121 | CVE Analysis and Report third-party-advisory
Submit #1004893 | nocodb <2026.08.1 Race Condition third-party-advisory
https://github.com/nocodb/nocodb/issues/14686 issue-tracking
https://github.com/nocodb/nocodb/ product