NocoDB contains a race condition in the password‑reset flow handled by users.service.ts. The flaw allows two concurrent reset requests to interfere, potentially enabling an attacker to force a password reset on an account they control or on an arbitrary user. This can result in an unauthorized password being set, which may grant the attacker full access to the compromised account. The weakness is classified as CWE‑362.

Deployments of NocoDB running version 2026.08.0 or earlier are affected, as the vulnerability originates in the package packages/nocodb/src/services/users/users.service.ts within the password‑reset component. All installations using any release up to that version are susceptible.

The CVSS score of 5.1 indicates medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be carried out remotely by submitting race‑prone password‑reset requests. Exploitation requires timing two concurrent reset attempts, which can be orchestrated from outside the system. The overall risk is moderate given the medium CVSS score and the availability of a remote exploitation path.