CVE-2026-24766 — NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS

CVE-2026-24766

NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS PUBLISHED

Description (CNA)

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator permissions can exploit prototype pollution in the `/api/v2/meta/connection/test` endpoint, causing all database write operations to fail application-wide until server restart. While the pollution technically bypasses SUPER_ADMIN authorization checks, no practical privileged actions can be performed because database operations fail immediately after pollution. Version 0.301.0 patches the issue.

Affected (CNA)

Vendor / product	Versions
nocodb / nocodb	affected < 0.301.0

CWE

CWE-1321

References

https://github.com/nocodb/nocodb/security/advisories/GHSA-95ff-46g6-6gw9

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.