Before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap
Not on CISA's list of exploited flaws, and not in the news we track.
0.48%
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-126273. Nothing runs until you send it.
NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control.
You are affected if
The fix