Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck
CVE-2026-119715NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers
Medium 4.3
In plain English
A medium-severity security flaw in nocodb from nocodb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 88.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.
Affected products (as reported)
Weakness: CWE-1021 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- GitHub Security Advisory (GHSA-3rj6-rvwh-j2xg) vendor-advisory
- https://github.com/nocodb/nocodb/commit/42128735eba328d157c2e90b98795cb248dc0847 patch
- nocodb 2026.08.0 Release Notes release-notes
- https://github.com/nocodb/nocodb product
- VulnCheck Advisory: NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers third-party-advisory