CVE-2026-53928
Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a stolen refresh token survived a password-forgot flow and could be used to mint fresh JWTs even after the user reset their password. passwordChange and passwordReset deleted the user's refresh tokens, but passwordForgot only rotated token_version and revoked OAuth tokens — it did not call UserRefreshToken.deleteAllUserToken(user.id). An attacker holding a captured refresh cookie could still exchange it for a new access token after the victim triggered the recovery flow. This vulnerability is fixed in 2026.05.1.
Summary dbcve.org
The passwordForgot flow in NocoDB failed to invalidate existing refresh tokens when users triggered password recovery. While passwordChange and passwordReset properly deleted all user refresh tokens by calling UserRefreshToken.deleteAllUserToken(user.id), passwordForgot only rotated token_version and revoked OAuth tokens without performing this deletion. This allowed attackers with stolen refresh cookies to continue exchanging them for fresh JWTs even after the victim completed the password reset flow.
Mitigation
Upgrade to NocoDB version 2026.05.1 or later, which includes the fix to properly invalidate all refresh tokens during the passwordForgot flow.