The refresh‑token cookie in NocoDB was created with httpOnly set to true, but the Secure flag and SameSite attribute were omitted. This means that when the application is accessed over plain HTTP, an attacker can capture the cookie in transit, and without SameSite enforcement, browsers will automatically send the cookie on cross‑site POST requests to the token‑refresh endpoint, enabling attackers to perform CSRF attacks that refresh the token. The result is that an attacker can obtain a valid session refresh token and potentially hijack a user’s session.

NocoDB software versions prior to 2026.04.1 are affected. The vendor is nocodb:nocodb according to the CNA.

The CVSS score of 5.4 indicates medium severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no known active exploits. Attackers could exploit the vulnerability by accessing the application over an unencrypted channel or by inducing a victim to visit a malicious site that triggers a cross‑site POST to the token‑refresh endpoint.