CVE-2026-28358: NocoDB Information Disclosure Flaw

CVE-2026-28358 Overview

NocoDB, an open-source software platform for building databases as spreadsheets, contains a user enumeration vulnerability in its password forgot endpoint. Prior to version 0.301.3, the password reset functionality returned different responses for registered and unregistered email addresses, allowing attackers to determine which email accounts exist within the system. This information disclosure vulnerability enables reconnaissance activities that could facilitate further attacks such as credential stuffing or targeted phishing campaigns.

Critical Impact

Attackers can enumerate valid user accounts by analyzing differential responses from the password reset endpoint, potentially enabling targeted attacks against confirmed users.

Affected Products

• NocoDB versions prior to 0.301.3
• NocoDB open-source deployments with exposed password reset functionality
• Self-hosted NocoDB instances without rate limiting protections

Discovery Timeline

• 2026-03-02 - CVE CVE-2026-28358 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-28358

Vulnerability Analysis

This vulnerability falls under CWE-204 (Observable Response Discrepancy), where an application's response behavior differs based on internal state that should not be exposed to users. In the context of NocoDB's password reset mechanism, the endpoint provided distinguishable responses depending on whether the submitted email address corresponded to a registered account or not.

User enumeration vulnerabilities, while often rated as lower severity, represent a significant reconnaissance opportunity for attackers. By automating requests to the password forgot endpoint with a list of potential email addresses, an attacker can build a verified list of valid users within the target NocoDB instance. This confirmed user list becomes valuable intelligence for subsequent attack phases.

Root Cause

The root cause lies in the password reset endpoint's implementation, which failed to return uniform responses regardless of whether an email exists in the system. Proper implementation should provide identical responses (both in content and timing) for all password reset requests, preventing attackers from inferring account existence through response analysis.

When handling password reset requests, the endpoint likely performed an immediate database lookup and returned different HTTP status codes, response messages, or response times based on the lookup result. This differential behavior created an observable side channel that leaked information about user account existence.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker would target the password forgot endpoint with automated requests containing various email addresses. By analyzing the responses—including HTTP status codes, response body content, and response timing—the attacker can determine which emails correspond to registered accounts.

The vulnerability does not require any user interaction and can be exploited with minimal technical skill. Attackers typically use wordlists containing common email patterns, leaked email databases, or organization-specific email formats to maximize enumeration effectiveness.

Detection Methods for CVE-2026-28358

Indicators of Compromise

• Unusual volume of requests to the password reset endpoint from single IP addresses
• Sequential or rapid-fire requests to /api/v1/auth/password/forgot or similar endpoints
• Requests containing different email addresses from the same source in short timeframes
• Failed authentication attempts following enumeration activity against discovered accounts

Detection Strategies

• Implement request rate monitoring on password reset endpoints to identify enumeration attempts
• Configure web application firewalls (WAF) to detect and block rapid sequential requests to authentication endpoints
• Deploy behavioral analytics to identify automated tooling patterns against password reset functionality
• Monitor for unusual patterns in password reset request volumes compared to baseline activity

Monitoring Recommendations

• Enable detailed logging for all authentication-related endpoints including password reset
• Set up alerts for threshold violations on password reset request rates per source IP
• Review logs for patterns indicating automated enumeration tools such as sequential email testing
• Correlate enumeration attempts with subsequent authentication failures to identify follow-up attacks

How to Mitigate CVE-2026-28358

Immediate Actions Required

• Upgrade NocoDB to version 0.301.3 or later immediately to apply the security patch
• Implement rate limiting on password reset endpoints as a defense-in-depth measure
• Review access logs for evidence of prior enumeration activity against the vulnerable endpoint
• Consider implementing CAPTCHA or similar challenges on password reset functionality

Patch Information

NocoDB has addressed this vulnerability in version 0.301.3. The patch ensures that the password reset endpoint returns consistent, uniform responses regardless of whether the submitted email address exists in the system. Users should upgrade to this version or later to remediate the vulnerability.

For detailed patch information, refer to the NocoDB Release Notes for version 0.301.3 and the GitHub Security Advisory GHSA-387m-j3p9-3php.

Workarounds

• Implement rate limiting at the reverse proxy or load balancer level to slow enumeration attempts
• Deploy a web application firewall with rules to detect and block automated enumeration patterns
• Consider temporarily disabling self-service password reset functionality until patching is complete
• Add CAPTCHA challenges to the password reset flow to impede automated enumeration

# Example: Rate limiting configuration for nginx reverse proxy
# Add to server or location block for password reset endpoint
limit_req_zone $binary_remote_addr zone=password_reset:10m rate=3r/m;

location /api/v1/auth/password/forgot {
    limit_req zone=password_reset burst=5 nodelay;
    proxy_pass http://nocodb_backend;
}