nocobase @nocobase/plugin-ai vulnerabilities

Latest nocobase @nocobase/plugin-ai CVEs

Newest publication first

1. CVE-2026-125397 NocoBase plugin-ai 2.1.0 through 2.2.41 Authorization Bypass via Sub-Agent Username Override

   Published 2026-11-09

   High·CVSS 7.1 EPSS 0.21%

   NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agen...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.