Prior to the 2026.04.1 release, the upload-by-URL path in NocoDB failed to enforce the NC_ATTACHMENT_FIELD_SIZE limit against either the remote file’s advertised Content‑Length header or the decoded length of a data: URI. An authenticated user could therefore upload a file larger than the configured per‑file size threshold, bypassing the size restriction. This flaw allows the storage of arbitrarily large files, potentially exhausting disk space or causing other resource‑based denial‑of‑service conditions. The vulnerability is considered CWE‑770, representing a limitation on available resources.

The affected product is NocoDB (vendor nocodb) running any release before 2026.04.1. Any user who relies on the upload‑by‑URL functionality and has authentication privileges is at risk.

The CVSS score of 2.1 reflects a low impact on confidentiality, integrity, and availability. There is no EPSS score available and the issue is not listed in the CISA KEV catalog. Exploitation requires valid authentication and use of the upload‑by‑URL path; it does not permit unauthenticated users to acquire or deliver large files.