High-severity authorization bypass found in NocoBase plugin-ai

GitHub's Security Advisory Database published a High-severity authorization bypass advisory for NocoBase's plugin-ai on November 10, 2026. The flaw, tracked as CVE-2026-125397, carries a CVSS score of 7.1 and lets authenticated users access and run AI agents, known in NocoBase as "AI employees", that they were not assigned to, exposing those agents' tool permissions and system prompts.

What changed

• CVE-2026-125397 is documented under GitHub Security Advisory GHSA-4g9p-3cc5-xh4q.
• The CVSS score is 7.1, rated High severity.
• The bug affects NocoBase plugin-ai versions 2.1.0 through 2.2.41.
• The root cause sits in the getAccessibleAIEmployee() function, where a role-derived access filter can be overridden by a supplied username.
• The dispatch-sub-agent-task tool can be used to run unauthorized AI employees with their own tools and permissions.
• The get-ai-employee tool can be used to read other AI employees' system prompts and tool configurations.

What it means for AI builders

The flaw is a direct privilege-escalation and data-exposure risk inside a widely used low-code platform's AI agent feature, and it is relevant to any team building or deploying multi-agent or no-code AI tooling. Because a low-privilege authenticated user can reach AI employees outside their assigned role, sensitive instructions and tool permissions configured for one agent are not reliably isolated from other users of the same NocoBase instance.

Exploitation status

No public proof-of-concept exploit has been confirmed for CVE-2026-125397, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Sources

• NocoBase plugin-ai Incorrect Authorization (CVE-2026-125397) (GitHub Security Advisory Database, November 10, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.