Incorrect Authorization Affecting nocodb package, versions >=0.300.0

nocodb is a NocoDB

Affected versions of this package are vulnerable to Incorrect Authorization via the OAuthTokenStrategy in the authentication component. An attacker can access endpoints reserved for other token types or privileged users by presenting an OAuth token to routes that accept it without route-level restriction. This allows unauthorized use of organization and metadata APIs, exposing administrative data and enabling privileged actions such as listing or modifying users, tokens, licenses, caches, and sync state.

Notes

• OAuth tokens were only blocked on endpoints that explicitly set blockOAuthTokenAccess; routes without that ACL metadata still accepted them, including org-level handlers that rely on the caller’s underlying user roles rather than a base-scoped context.
• The scope bypass is most relevant for third-party or narrowly scoped OAuth integrations: the token’s oauth_scope and oauth_granted_resources could be present on the request user, but the ACL layer did not consult them before authorizing access.

• GitHub Commit
• Maintainer's Advisory