Vulnerability GHSA-p9x3-w98f-7j3q
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
8 months ago
March 02, 2026 at 07:53 PM UTC
NocoDB Missing Ownership Validation in MCP Token Operations
<0.301.3
<0.301.3
Summary
NocoDB Missing Ownership Validation in MCP Token Operations
Details
Summary
The MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known.
Details
McpTokenService.get(), regenerateToken(), and delete() did not filter by fk_user_id. The analogous ApiTokensService correctly enforced ownership.
Impact
Limited — requires Creator role and knowledge of target token ID. Primary risk is denial of service (invalidating tokens) and scoped token disclosure.
Credit
This issue was reported by @bugbunny-research (bugbunny.ai).
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
4 months ago
NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
<=0.301.3 GHSA-hmcr-rmjq-47qr
<=0.301.3 GHSA-hmcr-rmjq-47qr
Medium Risk
4 months ago
NocoDB: Server-Side Request Forgery via Base Migration URL
<=0.301.3 GHSA-h6vv-pcq8-7xm4
<=0.301.3 GHSA-h6vv-pcq8-7xm4
Medium Risk
4 months ago
NocoDB: Stored Cross-Site Scripting via Secure Attachment
<=0.301.3 GHSA-6mhr-74x2-98v9
<=0.301.3 GHSA-6mhr-74x2-98v9
Medium Risk
4 months ago
NocoDB: Refresh Tokens Persist Through Password Recovery
<=0.301.3 GHSA-r989-7g3j-wjhw
<=0.301.3 GHSA-r989-7g3j-wjhw
Medium Risk
4 months ago
NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
<=0.301.3 GHSA-gprh-27j3-g5h4
<=0.301.3 GHSA-gprh-27j3-g5h4
Impacted packages
Timeline
Published
8 months ago
March 02, 2026 at 07:53 PM UTC
Fixed (0.301.3)
8 months ago
February 27, 2026 at 12:26 PM UTC
Last Modified
9 hours ago
November 05, 2026 at 10:45 PM UTC