CVE-2026-119715
4.3 MEDIUMpublic exploit availablePublished 2026-10-30 · Updated 2026-10-30
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-1021
Public exploit & PoC references
All references
- https://github.com/nocodb/nocodb
- https://github.com/nocodb/nocodb/commit/42128735eba328d157c2e90b98795cb248dc0847
- https://github.com/nocodb/nocodb/releases/tag/2026.08.0
- https://github.com/nocodb/nocodb/security/advisories/GHSA-3rj6-rvwh-j2xg
- https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-clickjacking-via-missing-frame-control-headers
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-106311
- MEDIUMCVE-2026-106356
- MEDIUMCVE-2026-106400
- LOWCVE-2026-108901PoC
- UNSCOREDCVE-2026-114125PoC
- MEDIUMCVE-2026-20942
- LOWCVE-2026-60008PoC
- MEDIUMCVE-2026-67079
Related by shared AI tags and CWE weakness class. Browse the full archive.