CVE-2026-126270

NocoDB versions prior to 2026.09.1 are vulnerable to an unauthenticated information disclosure due to missing authentication in the aggregated meta info route within utils.controller.ts . This flaw allows anonymous callers to access instance-wide metadata, including base enumerations, user counts...