A weakness has been identified in NocoDB up to 2026.07.0. The flaw resides in the validatePassword function of the /auth/user/signup module, where excessive authentication attempts are not properly restricted. This behavior allows an attacker to bypass rate limiting and carry out brute‑force password attempts against user accounts. The vulnerability is classified under CWE‑307 and CWE‑799, indicating insufficient authentication checks and improper validation.

All publicly available NocoDB releases up to and including 2026.07.0 are affected. The vendor product is NocoDB. No specific sub‑component versions beyond the last released version are noted; therefore, any installation running 2026.07.0 or earlier should be considered vulnerable.

The CVSS score is 6.3, which places it in the moderate severity band. EPSS information is not available, and the CVE is not listed in the CISA KEV catalog. Attackers can exploit this remotely, but the description rates the complexity as high and the overall exploitability as difficult, implying that dedicated attackers may need significant effort. Nevertheless, the inability to limit authentication attempts could facilitate credential‑guessing attacks in environments where NocoDB is exposed to the internet.