NocoDB: Stale Auth Cache After API Token Deletion

Root

Cause

The vulnerability arises from a cache invalidation gap in the API token deletion logic. When an administrator or user deletes an API token via the UI or API, the corresponding database row is removed, but the authentication cache entry keyed by the token value is not evicted [1]. As a result, the authentication middleware continues to treat the deleted token as valid until the cache entry ages out naturally [2].

Exploitation

No special network position is required; the attacker must possess a previously valid API token that the token holder has since deleted through the management interface. Since the token value is still cached, the attacker can reuse it for any API request that the token originally authorized. The deletion-to-revocation window is up to 72 hours, as the cache time-to-live (TTL) is three days [1][2].

Impact

This breaks the security guarantee that deleting an API token immediately revokes its access. An attacker who has obtained a valid token prior to its deletion can continue to use it for up to three days after the token is revoked, gaining unauthorized access to the affected application's resources [2].

Mitigation

The vendor has issued a security advisory (GHSA-f76x-f9vj-92jv) recommending that the application evict the token-value cache entry at the time of deletion [1][2]. Users should update to a patched version as soon as one is available, or apply any workarounds provided in the advisory.