CVE WATCH / VULNERABILITY DETAIL
CVE-2026-125397
HIGHCVSS 7.1NVD feed
Published 10 November 2026 · tracked since 10 November 2026
Description
NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run u
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-124604 MEDIUM 6.2
- CVE-2026-124603 MEDIUM 6.2
- CVE-2026-124602 MEDIUM 6.2
- CVE-2026-124601 MEDIUM 6.2
- CVE-2026-124599 MEDIUM 6.2
- CVE-2026-124598 HIGH 7.5
- CVE-2026-109810 MEDIUM 6.1
- CVE-2026-109799 HIGH 7.5
- CVE-2026-109797 HIGH 7.1
- CVE-2026-107244 HIGH 7.6