CVE-2026-126273

NocoDB versions before 2026.09.0 are vulnerable to a privilege escalation flaw in initAdminFromEnv.ts. The root cause is that the system silently skips the super-admin bootstrap process when the admin password environment variable is empty. An unauthenticated attacker can exploit this on a fresh ...