CVE-2026-126292

MediumCVSS 4.3/10Last modified Nov 13, 2026

Description

NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1262936.5NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because dat CVE-2026-1262947.5Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-f CVE-2026-1262956.8NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK CVE-2026-1262964.8NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesy CVE-2026-1262977.5NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote atta CVE-2026-1262987.5NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU throug CVE-2026-1262997.5NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust C CVE-2026-12636.4The Webling plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.9.0 due to insufficien CVE-2026-126304.3Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6l CVE-2026-1263005.3NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote att CVE-2026-1263015.3NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attack CVE-2026-1263023.3NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses the pathsec data-root