The vulnerability arises from NocoDB failing to send X-Frame-Options or Content Security Policy frame-ancestors headers, allowing any origin to embed the authenticated interface in a frame. An attacker can host a malicious page that overlays the victim’s session, tricking the user into performing click actions that modify or delete records, change sharing settings, or add collaborators. The vulnerability does not require any privileged input or local exploitation; it relies on the ability to frame a web page. The CWEs associated with the flaw indicate improper frame control handling rather than code injection or privilege escalation.

NocoDB versions prior to 2026.08.0 are affected. The vulnerability exists in all builds of the NocoDB repository that did not release the 2026.08.0 update, so any deployment using a version before that date is vulnerable.

With a CVSS score of 5.3 the vulnerability is considered moderate. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely via a web browser by embedding the vulnerable interface in a frame from a malicious domain. Successful exploitation results in abusive actions performed in the victim’s authenticated session, thereby compromising data integrity and potential stakeholder trust.