CVE-2026-28358CWE-204

NocoDB: User Enumeration via Password Reset Endpoint

Low · published March 2, 2026

CVSS v4.0
2.7
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.

The record
Technical detail
CVSS v4.0
2.7 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
EPSS
0.00736 · 53.9th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2026-03-02T16:16Z
EPSS history
Timeline
  • 02 MAR 16:16Z
    NocoDB: User Enumeration via Password Reset Endpoint
    cvelistv5