CVE-2026-53926
Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called from passwordChange, passwordForgot, and passwordReset. OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password, leaving an attacker-issued OAuth grant valid after the user believed they had locked the attacker out. This vulnerability is fixed in 2026.05.1.
Summary dbcve.org
In NocoDB prior to 2026.05.1, the revokeAllOAuthTokensByUser function in the users service was an empty stub. This function was called from passwordChange, passwordForgot, and passwordReset operations, but OAuth access and refresh tokens were never actually revoked. An attacker with existing OAuth tokens could retain access even after the legitimate user changed or reset their password, believing they had secured their account.
Mitigation
Upgrade to NocoDB version 2026.05.1 or later where the OAuth token revocation is properly implemented.