PT-2026-22629

CVE-2026-28358

Published

2026-03-02

Updated

2026-04-03

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.3

Description NocoDB is software for building databases as spreadsheets. The password forgot endpoint returns different responses for registered and unregistered emails, allowing user enumeration. The /forgot-password API endpoint is affected. The email parameter is used in the request.

Recommendations Update to version 0.301.3 or later.

Exploitability

Exploit

Fix

Researchers

Tulgaaaaaaaa

Vendors

Affected products

Weakness enumeration

CWE-204: Observable Response Discrepancy

Related identifiers

CVE-2026-28358