/Vulnerability Library

NocoDB - User Enumeration

CVE-2026-28358
Verified

Description

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.

Severity

Medium

CVSS Score

5.3

Exploit Probability

1%

Affected Product

nocodb

Published Date

April 2, 2026

Template Author

dhiyaneshdk

CVE-2026-28358.yaml
5.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE ID:
cve-2026-28358
CWE ID:
cwe-204

References

https://github.com/nocodb/nocodb/security/advisories/GHSA-387m-j3p9-3phphttps://github.com/nocodb/nocodb/releases/tag/0.301.3https://nvd.nist.gov/vuln/detail/CVE-2026-28358

Remediation Steps

Update to version 0.301.3 or later.