CVE-2026-28360: NocoDB: Plaintext Storage of Shared View Passwords
Summary Shared view passwords were stored in plaintext in the database and compared using direct string equality.
Details The password column in ncviews stored unhashed passwords. Verification used !== comparison across public-datas.service.ts, public-metas.service.ts, and calendar-datas.service.ts.
Impact If the database is compromised, shared view passwords are immediately readable. Risk is limited to password reuse scenarios.
Credit This issue was reported by @Tulgaaaaaaaa.
Other sources
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28360?
CVE-2026-28360 is classified as a high severity vulnerability due to the plaintext storage of shared view passwords.
How do I fix CVE-2026-28360?
To fix CVE-2026-28360, upgrade to NocoDB version 0.301.3 or later, which addresses the plaintext password storage issue.
What software is affected by CVE-2026-28360?
NocoDB versions up to and including 0.301.2 are affected by CVE-2026-28360.
What type of data is compromised in CVE-2026-28360?
CVE-2026-28360 compromises the security of shared view passwords as they are stored in plaintext in the database.
How are passwords verified in CVE-2026-28360?
In CVE-2026-28360, passwords are verified using direct string equality comparison, which is insecure.