CVE-2026-28361
CVE-2026-28361 · NocoDB: Missing Ownership Validation in MCP Token Operations
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known. This issue has been patched in version 0.301.3.
CVSS 4.9 · Moyenne · EPSS 0,2% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node