Medium severity · published Jun 23, 2026
CVE-2026-53926
NocoDB: OAuth Tokens Persist Through Security Events
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called from passwordChange, passwordForgot, and passwordReset. OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password, leaving an attacker-issued OAuth grant valid after the user believed they had locked the attacker out. This vulnerability is fixed in 2026.05.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
nocodb · nocodb
< 2026.05.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53926
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53926
github.com
https://github.com/nocodb/nocodb/security/advisories/GHSA-g72g-r7m4-9x4g
More from nocodb
9.0
CVE-2026-24769
NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
8.8
CVE-2026-28399
NocoDB: SQL Injection via DATEADD Formula
8.8
CVE-2022-2064
Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+
8.8
CVE-2022-2063
Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+
8.4
CVE-2026-47387
NocoDB: Stored Cross-Site Scripting via Form View Redirect URL