NocoDB fails to delete all refresh tokens when a user triggers the password‑forgot workflow. Prior to version 2026 05 01, the application rotated only the token_version field and revoked OAuth tokens but did not call UserRefreshToken.deleteAllUserToken(user.id). As a result, a stolen refresh cookie remains valid after the victim resets their password, allowing the attacker to exchange it for a new JWT and maintain access indefinitely. This flaw permits persistent unauthorized access through refresh tokens that should have been invalidated.

The issue affects all NocoDB versions older than 2026.05.1, a software product for building databases as spreadsheets.

The CVSS score of 6.3 indicates medium severity. Although the EPSS score is unavailable, the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker must first acquire a user’s refresh token, most plausibly by compromising the victim’s session. Once obtained, the attacker can use the token to renew access tokens after a password reset, providing a persistent foothold until the user’s tokens are purged or the system is patched. The vulnerability is fixed in 2026.05.1.