PT-2026-22629 · Nocodb · Nocodb

Tulgaaaaaaaa · Published 2026-03-02 · Updated 2026-04-03 · CVE-2026-28358

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.3

Description NocoDB is software for building databases as spreadsheets. The password forgot endpoint returns different responses for registered and unregistered emails, allowing user enumeration. The /forgot-password API endpoint is affected. The email parameter is used in the request.

Recommendations Update to version 0.301.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2026-28358

GHSA-387M-J3P9-3PHP

Affected Products

Nocodb

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28358.json · Exploit
• https://github.com/nocodb/nocodb/security/advisories/GHSA-387m-j3p9-3php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28358 · Security Note
• https://osv.dev/vulnerability/GHSA-387m-j3p9-3php · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28358 · Vendor Advisory
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/releases/tag/0.301.3 · Note
• https://twitter.com/pdnuclei_bot/status/2039855444571922934 · Twitter Post
• https://twitter.com/CVEnew/status/2028510370260717677 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028624677845827839 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028512227410456779 · Twitter Post
• https://t.me/CVEtracker/46137 · Telegram Post