The vulnerability is a prototype pollution flaw in the /api/v2/meta/connection/test endpoint that can be triggered by an authenticated user with org‑level‑creator permissions. After the pollution occurs, every database write operation fails across the entire application until the server is restarted, effectively preventing data persistence. The weakness is classified as CWE‑1321.

NocoDB, software used for building databases as spreadsheets. All versions running before 0.301.0 are affected, regardless of environment or deployment. The vulnerability does not affect other vendors or unrelated products.

The CVSS score of 4.9 places it in the low severity range, and the EPSS score of less than 1% indicates a very low but non‑zero likelihood of exploitation in the wild. NocoDB is not currently listed in the CISA KEV catalog. An attacker must authenticate as an org‑level‑creator, which limits the attack surface; however, once authenticated, the attacker can cause a denial of service by corrupting prototype data, requiring a server restart to regain normal operation.