p PatchFirst

CVE-2026-24766

CVE-2026-24766 · NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator permissions can exploit prototype pollution in the `/api/v2/meta/connection/test` endpoint, causing all database write operations to fail application-wide until server restart. While the pollution technically bypasses SUPER_ADMIN authorization checks, no practical privileged actions can be performed because database operations fail immediately after pollution. Version 0.301.0 patches the issue.

CVSS 4.9 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • nocodb

    Versions
    • < 0.301.0: Affected

    No fix published

  • nocodb npm

    Affected ranges
    • SEMVER: < 0.301.0

    Update to 0.301.0

Original sources

Check your server →