# CVE-2026-28358: NocoDB user enumeration via password reset endpoint

Source: https://junglewise.ai/threats/cve-2026-28358-nocodb-user-enumeration-in-password-reset-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-28358 · Severity: medium · CVSS 4 · Published 2026-03-02

NocoDB is an open-source database management and collaboration tool used as an Airtable alternative. An unauthenticated attacker could determine whether a specific email address is registered in a NocoDB instance by observing response differences from the password reset endpoint. While this does not expose credentials or data directly, it enables targeted account harvesting and social engineering attacks.

Technologies: [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-28358 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28358 being exploited in the wild.

**How severe is CVE-2026-28358?** Medium severity, with a CVSS score of 4, published 2 March 2026.

**Which products and versions are affected?** nocodb (npm) SEMVER:introduced=0,fixed=0.301.3.

**Is there a fix for CVE-2026-28358?** Yes. nocodb (npm): upgrade to 0.301.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28358 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-28358?** Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nocodb (npm): upgrade to 0.301.3 or later

  ```sh
  npm install nocodb@0.301.3
  ```


## Technical details

The vulnerability is an information disclosure flaw (CWE-204: Observable Response Discrepancy) in the POST /api/v2/auth/password/forgot endpoint. The endpoint returned different HTTP responses for registered emails (success message) versus unregistered emails ('Your email has not been registered.'), allowing unauthenticated attackers to enumerate valid email accounts without authentication or preconditions. No user interaction is required. The attack requires only network access to the endpoint and the ability to send HTTP requests. The fix was implemented in version 0.301.3 to return uniform responses for all emails. No evidence of exploitation in the wild has been reported.

## Affected products

- NocoDB nocodb <= 0.301.2

## Identifiers

- CVE-2026-28358
- GHSA-387m-j3p9-3php

## Timeline

- 2026-03-02: disclosed
- 2026-02-27: patched: version 0.301.3 released

## References

- [https://github.com/nocodb/nocodb/security/advisories/GHSA-387m-j3p9-3php](https://github.com/nocodb/nocodb/security/advisories/GHSA-387m-j3p9-3php)
- [https://github.com/nocodb/nocodb](https://github.com/nocodb/nocodb)
- [https://github.com/nocodb/nocodb/releases/tag/0.301.3](https://github.com/nocodb/nocodb/releases/tag/0.301.3)

## Related threats

- [NocoDB SSRF in spreadsheet-import endpoint](https://junglewise.ai/threats/cve-2026-53931-nocodb-ssrf-in-spreadsheet-import-endpoint)
- [NocoDB SSRF in base-migration endpoint](https://junglewise.ai/threats/cve-2026-53930-nocodb-ssrf-in-base-migration-endpoint)
- [NocoDB stored cross-site scripting in secure attachments](https://junglewise.ai/threats/cve-2026-53929-nocodb-stored-cross-site-scripting-in-secure-attachments)
- [NocoDB insufficient session expiration in password recovery flow](https://junglewise.ai/threats/cve-2026-53928-nocodb-insufficient-session-expiration-in-password-recovery-flow)
- [NocoDB SSRF in spreadsheet-fetch endpoint](https://junglewise.ai/threats/cve-2026-53927-nocodb-ssrf-in-spreadsheet-fetch-endpoint)