CVE-2026-116120

Affected NocoDB versions up to 2026.07.0 allow the UserRefreshToken.deleteAllUserToken endpoint in the PublicApiLimiterGuard to be called without any built‑in rate limiting. An attacker can invoke this operation repeatedly to allocate large amounts of memory or other resources on the server. Because the function is exposed on unauthenticated signup and password‑forgot requests, the exploit can be performed remotely and does not require prior authentication. The vendor acknowledges that the lack of a pass‑through limiter is intentional, but this design allows for a denial‑of‑service situation.

All NocoDB installations (product NocoDB) running any version up to and including 2026.07.0 are affected. The vulnerability originates in the /auth/user/signup component and the PublicApiLimiterGuard logic. No other vendors or products are listed. Administrators should verify the installed version and consider updating or applying workarounds.

The CVSS score of 6.3 classifies this as medium severity. The EPSS score is not available, so the likelihood of exploitation cannot be determined from the data. The vulnerability is not listed in CISA's KEV catalog, limiting its visibility to known threat actors. Attackers would need to execute repeated Remote API calls to cause resource exhaustion, which the description indicates has high complexity and is considered difficult to exploit. No automatic exploitation mechanisms have been reported. The lack of in‑app rate limiting is a clear weakness that can be leveraged to affect availability.