GitHub Advisoryadvisory · npm

GHSA-387m-j3p9-3php NocoDB Vulnerable to User Enumeration via Password Reset Endpoint

LOW Published 2026-03-02 Modified 2026-03-02 Official page ↗
Aliases
CVE-2026-28358
Ecosystem
npm
Packages
nocodb
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-204
Reviewed
2026-03-02

Affected packages

• npm nocodb: < 0.301.3 → fixed in 0.301.3

Description

Summary The password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. Details `POST /api/v2/auth/password/forgot` returned a success message for registered emails but `'Your email has not been registered.'` for unknown emails. The fix returns a uniform response regardless of whether the email exists. Impact An unauthenticated attacker can determine whether an email is registered. No credentials or data are exposed. Credit This issue was reported by @Tulgaaaaaaaa.

Related

Alias · CVE (1)

  • CVE-2026-28358 NocoDB is software for building databases as spreadsheets. vulnerability

Weakness · CWE (1)

  • CWE-204 Observable Response Discrepancy weakness

References