nocodb/nocodb · Security
NocoDB Missing Ownership Validation in MCP Token Operations
- GHSA ID
- GHSA-p9x3-w98f-7j3q
- CVE ID
- CVE-2026-28361
- Severity
- medium
- Published
- Updated
- CVSS v4
- 4.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Description
Summary
The MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known.
Details
McpTokenService.get(), regenerateToken(), and delete() did not filter by fk_user_id. The analogous ApiTokensService correctly enforced ownership.
Impact
Limited — requires Creator role and knowledge of target token ID. Primary risk is denial of service (invalidating tokens) and scoped token disclosure.
Credit
This issue was reported by @bugbunny-research (bugbunny.ai).
CWEs
- CWE-639 · Authorization Bypass Through User-Controlled Key
References
- https://github.com/nocodb/nocodb/security/advisories/GHSA-p9x3-w98f-7j3q ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-28361 ↗
- https://github.com/nocodb/nocodb/releases/tag/0.301.3 ↗
- https://github.com/nocodb/nocodb/commit/4e736ee40951c7b4f9760f372780e0712c44b9dd ↗
- https://github.com/advisories/GHSA-p9x3-w98f-7j3q ↗