CVE-2026-46550

5.4 Moyenne

Publiée le 23/06/2026 à 23:16 · Modifiée le 25/06/2026 à 16:21 · Analyse NVD reportée · Source : security-advisories@github.com

Description

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the refresh-token cookie was set with httpOnly: true but missing both the secure flag and the sameSite attribute. Over plain HTTP the cookie could be intercepted on the network; without sameSite, browsers attached it to cross-site POSTs, enabling CSRF against the token-refresh endpoint. This vulnerability is fixed in 2026.04.1.

Traduire en français

Produits concernés

nocodb

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-614

Références

https://github.com/nocodb/nocodb/security/advisories/GHSA-f74w-272x-mqcv

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories