NocoDB's authentication middleware mistakenly keeps a deleted API token in its cache, allowing continued use until the cache expires. The flaw arises when the token deletion endpoint removes the row from the database but fails to evict the token entry from the cache, creating a revocation window of up to three days. An attacker who can delete a token—whether by legitimate use or by compromising a user session—may still exploit the token to access the API and the underlying data, effectively bypassing authorization controls until the cached entry ages out.

NocoDB is affected in all releases before version 2026.04.4. The vulnerability exists in the core authentication subsystem of NocoDB and impacts any deployment that relies on API tokens for access. Deployments using this software should verify that their version is 2026.04.4 or newer.

The CVSS score of 2.3 indicates low overall severity, and the vulnerability is not currently listed in the CISA KEV catalog. The EPSS score is not available, but the lack of inclusion in KEV and the low CVSS suggest a limited likelihood of exploitation in the wild. The attack vector is inferred to be remote, via the NocoDB web interface or API, since an attacker would need the ability to delete a token to maintain the stale cache. A compromised user or application with admin privileges could trigger deletion, leaving the token valid for up to three days.