CVE-2026-28358
NocoDB is software for building databases as spreadsheets.
Published Mar 2, 2026 · updated Jun 17, 2026 · nocodb nocodb
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 2, 2026 · NIST NVD
Detected
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.
Jun 17, 2026 · NIST NVD
Updated
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.
Affected
- cpe nocodb/nocodbversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-28358
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-28358
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.
nvd.nist.gov