Advisory · CVE-2026-126273
NocoDB Create-role users can mint Owner API tokens
NocoDB before 0.288.2 has an improper privilege management flaw in API token generation that lets authenticated users with the Create role create tokens with Owner privileges. Attackers can generate API tokens granting full owner access to the workspace, enabling privilege escalation and full control over the NocoDB instance; fixed in 0.288.2.
- Vendor
- NocoDB
- Product
- NocoDB
- Identifier / CWE
- CVE-2026-126273
CWE-269 - Action timing
- Immediate
Explain it like I’m five
In NocoDB, a user who can only create things is supposed to stay limited. A bug in token creation lets them mint a token with owner powers, handing them the keys to the whole workspace.
- 01Token requested
An authenticated user with the Create role requests a new API token.
- 02Owner privileges granted
The token is issued with Owner privileges instead of Create-level privileges.
- 03Workspace controlled
The attacker uses the token for full owner access to the workspace.
What happened
NocoDB before 0.288.2 contains an improper privilege management vulnerability in API token generation that allows authenticated users with Create role to create tokens with Owner privileges. Attackers can generate API tokens that grant full owner access to the workspace, enabling privilege escalation and full control over the NocoDB instance. The record rates it critical at CVSS 9.2 under version 4.0.
What to do
- Upgrade NocoDB to 0.288.2 or later.
- Audit API tokens and revoke any with Owner scope that the team did not issue.
- Rotate tokens for workspace owners.
- Review workspace activity for changes made with unexpected Owner tokens.
- Confirm the patched version is running.
Management note
A low-privilege role that can mint owner tokens breaks the whole permission model. Patch and then audit every token, not just the accounts.