CVE-2026-28358: NocoDB User Enumeration via Password Reset Endpoint
Summary
CVE-2026-28358: NocoDB Vulnerable to User Enumeration via Password Reset Endpoint. Affects nocodb versions < 0.301.3. Fixed in 0.301.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into smart APIs, allowing users to create applications without extensive coding knowledge. It provides a user-friendly interface for managing data and building applications. However, a vulnerability was discovered in its password reset functionality, which could allow attackers to enumerate registered users.
Vulnerability Detail
The vulnerability arises from the password forgot endpoint, which differentiates responses based on whether the provided email is registered. Specifically, the endpoint returns a success message for registered emails and a distinct error message for unregistered emails. This behavior enables an unauthenticated attacker to ascertain the existence of registered emails, potentially leading to targeted attacks. The technical aspect of this vulnerability is categorized under CWE-204, which pertains to user enumeration.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the response logic in your application to ensure that the password reset endpoint does not disclose whether an email is registered. This can be done by returning a generic message for all requests, such as 'If your email is registered, you will receive a password reset link.'
Conclusion
In summary, the vulnerability identified as CVE-2026-28358 in NocoDB allows for user enumeration via the password reset endpoint. It is crucial to update to version 0.301.3 or later to mitigate this risk. Additionally, implementing a generic response can serve as a temporary workaround while ensuring user data remains secure.
See every vulnerability recorded for nocodb →
FAQ
The vulnerability allows attackers to determine if an email is registered by analyzing the responses from the password reset endpoint.
An attacker could use this information to target registered users for phishing attacks or other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just your package-lock.json file.
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
