- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 48
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://nocodb.com
Products and areas 12
- Authentication end to end: password login, invitation flow, session issuance, single sign-on and any OAuth or SAML option present
- File and attachment handling, both upload and the URLs attachments are served from
- Formula, rollup and lookup field evaluation, where stored expressions are computed server-side
- Shared views and shared bases, the surface NocoDB exposes to people with a link and no account, including password-protected shares
- The external data source connectors, the part of the product that holds database credentials and turns interface actions into queries against somebody's production database
- The import and export tooling, including Airtable import, CSV and Excel parsing
- The metadata database, which holds connection strings and credentials for every source the instance fronts
- The query construction layer in full: filters, sorts, groupings, formula fields, aggregations and every other place a user parameter becomes part of SQL
- The repository policy asks for private reports at a dedicated security address and through GitHub, and it states no component carve-out, so the whole of NocoDB is in scope
- The REST API and the API token mechanism, which exposes table data to scripted consumers
- The workspace, base and table permission model, including the checks that keep one team's bases out of another's reach
- Webhooks and automations, where a record change triggers an outbound request to a destination the user supplies
Out of scope (6)
- A permission or share link an administrator created deliberately
- Deployment configuration, including an instance exposed to the internet without the documented hardening or run with a default admin credential
- Testing against instances you do not own, which in this product means querying someone else's production database
- The hosted service's underlying infrastructure, as distinct from the NocoDB code running on it
- Upstream Node and npm dependency issues, unless NocoDB's own use of the dependency is what makes the defect reachable
- Vulnerabilities in Postgres, MySQL or another backing database engine, which are other projects' code
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Report privately to the address on the policy page , or through GitHub private vulnerability reporting on nocodb/nocodb, which is enabled
-
Say which external data source your reproduction used.
-
State the base role you started from.
-
Test against a database you own.
Not accepted
-
Vulnerabilities in Postgres, MySQL or another backing database engine, which are other projects' code
-
Upstream Node and npm dependency issues, unless NocoDB's own use of the dependency is what makes the defect reachable
-
Deployment configuration, including an instance exposed to the internet without the documented hardening
-
A permission or share link an administrator created deliberately
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-28396 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password. This issue has been patched in version 0.301.3. | Medium 4.9 | 2 Mar 2026 |
| CVE-2026-28397 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, comments rendered via v-html without sanitization enable stored XSS. This issue has been patched in version 0.301.3. | Medium 5.3 | 2 Mar 2026 |
| CVE-2026-28398 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, user-controlled content in comments and rich text cells was rendered via v-html without sanitization, enabling stored XSS. This issue has been patched in version 0.301.3. | Medium 5.3 | 2 Mar 2026 |
| CVE-2026-28399 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3. | Medium 6.2 | 2 Mar 2026 |
| CVE-2026-28401 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables stored XSS. This issue has been patched in version 0.301.3. | Medium 5.3 | 2 Mar 2026 |
| CVE-2026-28357 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3. | Medium 5.3 | 2 Mar 2026 |
| CVE-2026-28358 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3. | Low 2.7 | 2 Mar 2026 |
| CVE-2026-28359 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. This issue has been patched in version 0.301.3. | Medium 5.3 | 2 Mar 2026 |
| CVE-2026-28360 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3. | Low 2.7 | 2 Mar 2026 |
| CVE-2026-28361 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known. This issue has been patched in version 0.301.3. | Medium 4.9 | 2 Mar 2026 |
| CVE-2026-24769 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment. Because the malicious payload i | High 8.5 | 28 Jan 2026 |
| CVE-2026-24766 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator permissions can exploit prototype pollution in the `/api/v2/meta/connection/test` endpoint, causing all database write operations to fail application-wide until server restart. While the pollution technically bypasses SUPER_ADMIN authorization checks, no practical privi | Medium 4.9 | 28 Jan 2026 |
| CVE-2026-24767 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation. This allows limited outbound requests to | Medium 4.9 | 28 Jan 2026 |
| CVE-2026-24768 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an unvalidated redirect (open redirect) vulnerability exists in NocoDB’s login flow due to missing validation of the `continueAfterSignIn` parameter. During authentication, NocoDB processes a user-controlled redirect value and conditionally performs client-side navigation without enforcing any restrictions on the | Medium 5.7 | 28 Jan 2026 |
| CVE-2025-27506 | NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template | Medium 5.4 | 6 Mar 2025 |
| CVE-2023-50718 | NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch for the issue. | Medium 6.5 | 14 May 2024 |
| CVE-2023-50717 | NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site scripting attack. This allows remote attacker to execute JavaScript code in the context of the user accessing the vector. | Medium 5.7 | 14 May 2024 |
| CVE-2023-49781 | NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the function replaceUrlsWithLink(). This function recognizes the pattern URI::(XXX) and cr | High 7.3 | 14 May 2024 |
| CVE-2023-43794 | Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticated attacker with creator access to query the underlying database. By supplying a specially crafted payload to the given an attacker can inject arbitrary SQL queries to be executed. Since this is a blind SQL injection, an attacker may need to use time-based pay | Medium 6.5 | 17 Oct 2023 |
| CVE-2023-5104 | Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0. | Medium 6.5 | 21 Sep 2023 |
| CVE-2023-35843 | NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information. | High 7.5 | 19 Jun 2023 |
| CVE-2022-3423 | Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0. | High 7.3 | 7 Oct 2022 |
| CVE-2022-2339 | With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information. | High 7.5 | 7 Jul 2022 |
| CVE-2022-2079 | Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+. | Medium 5.4 | 14 Jun 2022 |
| CVE-2022-2062 | Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+. | High 7.5 | 13 Jun 2022 |
| CVE-2022-2063 | Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+. | High 8.8 | 13 Jun 2022 |
| CVE-2022-2064 | Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+. | High 8.8 | 13 Jun 2022 |
| CVE-2022-2022 | Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7. | Medium 5.4 | 7 Jun 2022 |
| CVE-2022-22120 | In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses. | Medium 5.3 | 10 Jan 2022 |
| CVE-2022-22121 | In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens it, the payload gets executed. | High 8.0 | 10 Jan 2022 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 43 Last 12 months 48 Lifetime Access control 40 % Injection 25 % Auth bypass 20 % Info disclosure 15 % Latest advisories Loading the feed Overview NocoDB is the Airtable-style front end teams point at a database they already own, and it holds admin-grade credentials for production Postgres and MySQL instances so it can render and edit them. That is the anchor for cost: a flaw here inherits the privilege of the connection string, and the reachable data is the whole backing database rather than one application's tables. Forty-three of its forty-eight published advisories landed in the last twelve months, the busiest unpaid pipeline in this category alongside Frappe. The project takes reports privately and pays nothing for them, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The repository policy asks for private reports at a dedicated security address and through GitHub, and it states no component carve-out, so the whole of NocoDB is in scope The external data source connectors, the part of the product that holds database credentials and turns interface actions into queries against somebody's production database The query construction layer in full: filters, sorts, groupings, formula fields, aggregations and every other place a user parameter becomes part of SQL The workspace, base and table permission model, including the checks that keep one team's bases out of another's reach Shared views and shared bases, the surface NocoDB exposes to people with a link and no account, including password-protected shares The REST API and the API token mechanism, which exposes table data to scripted consumers Authentication end to end: password login, invitation flow, session issuance, single sign-on and any OAuth or SAML option present File and attachment handling, both upload and the URLs attachments are served from Webhooks and automations, where a record change triggers an outbound request to a destination the user supplies The import and export tooling, including Airtable import, CSV and Excel parsing The metadata database, which holds connection strings and credentials for every source the instance fronts Formula, rollup and lookup field evaluation, where stored expressions are computed server-side Out of scope Vulnerabilities in Postgres, MySQL or another backing database engine, which are other projects' code Upstream Node and npm dependency issues, unless NocoDB's own use of the dependency is what makes the defect reachable Deployment configuration, including an instance exposed to the internet without the documented hardening or run with a default admin credential A permission or share link an administrator created deliberately Testing against instances you do not own, which in this product means querying someone else's production database The hosted service's underlying infrastructure, as distinct from the NocoDB code running on it Most-valued findings SQL injection anywhere in the query construction path. On this product injection is not a database read scoped to the application, it runs with the connection string's privilege against a production database the operator never intended NocoDB to control fully Anything that discloses or reuses a stored data source credential, since the connection strings in the metadata database are the highest-value object in the deployment Cross-workspace and cross-base access on a shared instance, where one team's tables reach another's Shared view and shared base defects, including password bypass on a protected share, because that surface is reachable by anyone holding a link and no account at all API token scope defects, where a token issued for one base reads or writes another Authentication bypass and the invitation flow, where joining a workspace you were never invited to is a direct route to the data behind it Formula and expression evaluation that escapes into server-side code execution or into unintended SQL Server-side request forgery through webhooks, the data source connection form or any other outbound request whose destination the caller supplies. The connection form is particularly attractive because it makes the server talk to an arbitrary host on the internal network Unauthorised attachment retrieval through predictable or unchecked URLs Privilege escalation inside a workspace, viewer to editor to owner, on an instance that fronts several databases at once Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately to [email protected] , or through GitHub private vulnerability reporting on nocodb/nocodb, which is enabled The vendor page at nocodb.com/security returns a 404. The repository SECURITY.md is the canonical policy, so read that one Say which external data source your reproduction used. NocoDB behaves differently against its own metadata database, against Postgres and against MySQL, and an injection that only fires on one engine is still a finding worth filing State the base role you started from. Authorisation here is layered across workspace, base and table, and a report without the starting role cannot be reproduced Test against a database you own. A live probe against somebody else's NocoDB instance is a probe against whatever production database sits behind it There is no reward tier and no payment to negotiate Disclosure Coordinated privately by email or GitHub advisory and published as a GitHub Security Advisory alongside a patched release. At forty-three advisories in a year the pipeline is plainly attended and moving fast, and the public record shows a project shipping fixes in a steady stream rather than in occasional batches. No fixed embargo length is published. Time disclosure to the release that carries the fix, and account for self-hosted operators who upgrade a container far less often than the project ships. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability