CVE-2026-28358
NoneCVSS
—
EPSS
0.7%
Published
Mar 2, 2026
CISA due date
—
The record
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | nocodb | 0 | 0.301.3 |
Related vulnerabilities
- GHSA-387m-j3p9-3php NocoDB Vulnerable to User Enumeration via Password Reset Endpoint Same vulnerability
- CVE-2026-53928 NocoDB is software for building databases as spreadsheets. Also affects nocodb
- CVE-2026-53929 NocoDB is software for building databases as spreadsheets. Also affects nocodb
- CVE-2026-53927 NocoDB is software for building databases as spreadsheets. Also affects nocodb
- CVE-2026-53930 NocoDB is software for building databases as spreadsheets. Also affects nocodb
- CVE-2026-53931 NocoDB is software for building databases as spreadsheets. Also affects nocodb
- CVE-2026-53926 NocoDB is software for building databases as spreadsheets. Also affects nocodb
- CVE-2026-47386 NocoDB is software for building databases as spreadsheets. Also affects nocodb