Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2026-28361

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known. This issue has been patched in version 0.301.3.

VectorNETWORK

PublishedMar 02, 2026, 17:16

Published Bysecurity-advisories@github.com

Base Score

Score6.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

nocodb(npm)00.301.3N/A

References

https://github.com/nocodb/nocodb/releases/tag/0.301.3
https://github.com/nocodb/nocodb/security/advisories/GHSA-p9x3-w98f-7j3q

Weakness Type

CWE-639

CVSS Metrics

Base Score

4.9

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Base SeverityMedium

Version

4.0

Attack Vector (AV)

NETWORK