CVE-2026-28358 — MEDIUM (5.3)

Q: How severe is CVE-2026-28358?

CVE-2026-28358 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-28358?

Check the references section above for vendor advisories and patch information. Affected products include: Nocodb Nocodb.

Vulnerability Description

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Nocodb	Nocodb	< 0.301.3

Related Weaknesses (CWE)

CWE-204

References

https://github.com/nocodb/nocodb/releases/tag/0.301.3ProductRelease Notes
https://github.com/nocodb/nocodb/security/advisories/GHSA-387m-j3p9-3phpVendor Advisory

FAQ

What is CVE-2026-28358?

CVE-2026-28358 is a vulnerability with a CVSS score of 5.3 (MEDIUM). NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enu...

How severe is CVE-2026-28358?

CVE-2026-28358 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-28358?

Check the references section above for vendor advisories and patch information. Affected products include: Nocodb Nocodb.