NocoDB MCP Token Service Ownership Validation Vulnerability

A vulnerability exists in NocoDB's MCP token service in versions prior to 0.301.3, where the service failed to validate token ownership. This flaw allowed a user with the Creator role to read, regenerate, or delete another user's MCP tokens, provided the token ID was known. The issue arose because the token service operations did not filter by user ID, unlike the related API tokens service, which correctly enforced ownership.

Impact

Exploitation of this vulnerability could lead to unauthorized access to, and manipulation of, MCP tokens belonging to other users, including the ability to invalidate those tokens. This could disrupt workflows or integrations relying on those tokens.

Remediation

Users can upgrade to NocoDB version 0.301.3 or later to address this vulnerability.