Description
NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nocodb nocodb
Default version status: unaffected
0 to < 2026.08.0affected
References
- https://github.com/nocodb/nocodb/security/advisories/GHSA-3rj6-rvwh-j2xg ↗
- https://github.com/nocodb/nocodb/commit/42128735eba328d157c2e90b98795cb248dc0847 ↗
- https://github.com/nocodb/nocodb/releases/tag/2026.08.0 ↗
- https://github.com/nocodb/nocodb ↗
- https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-clickjacking-via-missing-frame-control-headers ↗