CVE-2026-28358: NocoDB: User Enumeration via Password Reset Endpoint
Summary The password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration.
Details POST /api/v2/auth/password/forgot returned a success message for registered emails but 'Your email has not been registered.' for unknown emails. The fix returns a uniform response regardless of whether the email exists.
Impact An unauthenticated attacker can determine whether an email is registered. No credentials or data are exposed.
Credit This issue was reported by @Tulgaaaaaaaa.
Other sources
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28358?
CVE-2026-28358 is a user enumeration vulnerability with a high impact on user privacy.
How do I fix CVE-2026-28358?
To address CVE-2026-28358, ensure that the password reset endpoint returns a generic message regardless of the email's registration status.
Which software versions are affected by CVE-2026-28358?
CVE-2026-28358 affects NocoDB versions prior to 0.301.3.
What is the nature of the vulnerability in CVE-2026-28358?
CVE-2026-28358 allows an attacker to determine if an email is registered in the system through different responses to password reset requests.
Is user information vulnerable due to CVE-2026-28358?
Yes, due to CVE-2026-28358, user information could be compromised as attackers can enumerate valid usernames.