GitHub Advisoryadvisory · npm

GHSA-p9x3-w98f-7j3q NocoDB Missing Ownership Validation in MCP Token Operations

MEDIUM Published 2026-03-02 Modified 2026-03-02 Official page ↗
Aliases
CVE-2026-28361
Ecosystem
npm
Packages
nocodb
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-639
Reviewed
2026-03-02

Affected packages

• npm nocodb: < 0.301.3 → fixed in 0.301.3

Description

Summary The MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known. Details `McpTokenService.get()`, `regenerateToken()`, and `delete()` did not filter by `fk_user_id`. The analogous `ApiTokensService` correctly enforced ownership. Impact Limited — requires Creator role and knowledge of target token ID. Primary risk is denial of service (invalidating tokens) and scoped token disclosure. Credit This issue was reported by @bugbunny-research (bugbunny.ai).

Related

Alias · CVE (1)

  • CVE-2026-28361 NocoDB is software for building databases as spreadsheets. vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References