CVE-2022-2064: Insufficient Session Expiration in NocoDB
Summary
CVE-2022-2064: Insufficient Session Expiration in NocoDB. Affects nocodb versions < 0.91.9. Fixed in 0.91.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source project management tool that provides a web-based interface for creating and managing databases. It allows users to easily create tables, define relationships, and perform CRUD operations on the data. The vulnerability identified as CVE-2022-2064 in NocoDB versions prior to 0.91.9 relates to insufficient session expiration.
Vulnerability Detail
The vulnerability in NocoDB allows an attacker to exploit insufficient session expiration. This means that once a user logs into the application, their session remains active for an extended period of time, even after they have closed the browser or logged out. This can lead to unauthorized access to sensitive information or actions on behalf of the user. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.91.9
This is the first release that contains the fix.
npm install nocodb@0.91.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of NocoDB.
Conclusion
The vulnerability in NocoDB versions prior to 0.91.9 allows for insufficient session expiration, potentially leading to unauthorized access to sensitive information or actions on behalf of the user. Users should upgrade to version 0.91.9 or later to fix this vulnerability. For further support, contact DevNack.com.
See every vulnerability recorded for nocodb →
FAQ
The vulnerability allows an attacker to maintain an active session even after the user has logged out, potentially leading to unauthorized access to sensitive information or actions on behalf of the user.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your NocoDB installation is affected by this vulnerability. Simply provide the package-lock.json file of your installation to the playground, and it will alert you if the vulnerability is present.
At the time of this advisory, there are no known exploits for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate the risk.
No, the vulnerability is related to the session expiration mechanism within NocoDB. It is recommended to upgrade to the latest version to fix the issue.
For further support on vulnerability remediation or any other questions related to NocoDB, you can reach out to info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
