CVE-2026-126291

NocoDB versions prior to 2026.06.2 are vulnerable to an SQL injection flaw in base-user.cte.utils.ts. The root cause is the unsafe concatenation of base members' email addresses into SQL queries used to resolve user , created-by , or last-modified-by fields. Registered users can exploit this by s...

EUVD-2026-125230

NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a...