NocoDB Missing Ownership Validation in MCP Token Operations

Summary

The MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known.

Details

McpTokenService.get(), regenerateToken(), and delete() did not filter by fk_user_id. The analogous ApiTokensService correctly enforced ownership.

Impact

Limited — requires Creator role and knowledge of target token ID. Primary risk is denial of service (invalidating tokens) and scoped token disclosure.

Credit

This issue was reported by @bugbunny-research (bugbunny.ai).