PT-2026-22633 · Nocodb · Nocodb

Bugbunny-Research · Published 2026-03-02 · Updated 2026-03-02 · CVE-2026-28396

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.3

Description NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset process did not invalidate existing refresh tokens. This allowed an attacker who previously obtained a refresh token to continue creating valid JSON Web Tokens (JWTs) even after the user reset their password. The password reset flow did not revoke existing refresh tokens, enabling continued access with stolen tokens.

Recommendations Update to version 0.301.3 or later.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-28396

GHSA-X4VH-J75G-268G

Affected Products

Nocodb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28396.json · Exploit
• https://github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x4vh-j75g-268g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28396 · Security Note
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/releases/tag/0.301.3 · Note
• https://reddit.com/r/VulnMatter/comments/1rj3cki/resumen_diario_de_vulnerabilidades_02032026 · Reddit Post
• https://twitter.com/CVEnew/status/2028510366414585911 · Twitter Post
• https://t.me/CVEtracker/46141 · Telegram Post
• https://twitter.com/infoflowcloud/status/2028512140890406978 · Twitter Post