NocoDB Missing Ownership Validation in MCP Token Operations

Summary The MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known. Details McpTokenService.get, regenerateToken, and delete did not filter by fkuserid. The analogous...

CVE-2026-28361

CVE-2026-28361 affects NocoDB prior to version 0.301.3, where the MCP token service did not validate token ownership. This allowed a Creator within the same base to read, regenerate, or delete another user’s MCP tokens if the token ID was known. The issue is fixed in 0.301.3. Remediation: upgrade...