GitHub Advisoryadvisory · npm

GHSA-mpp2-x7wv-38hv NocoDB has Plaintext Storage of Shared View Passwords

LOW Published 2026-03-02 Modified 2026-03-02 Official page ↗
Aliases
CVE-2026-28360
Ecosystem
npm
Packages
nocodb
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-256
Reviewed
2026-03-02

Affected packages

• npm nocodb: < 0.301.3 → fixed in 0.301.3

Description

Summary Shared view passwords were stored in plaintext in the database and compared using direct string equality. Details The `password` column in `nc_views` stored unhashed passwords. Verification used `!==` comparison across `public-datas.service.ts`, `public-metas.service.ts`, and `calendar-datas.service.ts`. Impact If the database is compromised, shared view passwords are immediately readable. Risk is limited to password reuse scenarios. Credit This issue was reported by @Tulgaaaaaaaa.

Related

Alias · CVE (1)

  • CVE-2026-28360 NocoDB is software for building databases as spreadsheets. vulnerability

Weakness · CWE (1)

  • CWE-256 Plaintext Storage of a Password weakness

References