Vulnerability Description
NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/nocodb/nocodb
- https://github.com/nocodb/nocodb/commit/42128735eba328d157c2e90b98795cb248dc0847
- https://github.com/nocodb/nocodb/releases/tag/2026.08.0
- https://github.com/nocodb/nocodb/security/advisories/GHSA-3rj6-rvwh-j2xg
- https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-clickjacking-via-mi
FAQ
What is CVE-2026-119715?
CVE-2026-119715 is a vulnerability with a CVSS score of 4.3 (MEDIUM). NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers ...
How severe is CVE-2026-119715?
CVE-2026-119715 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119715?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.