# CVE-2026-47380: NocoDB user enumeration via sign-in timing discrepancy

Source: https://junglewise.ai/threats/cve-2026-47380-nocodb-user-enumeration-via-sign-in-timing-discrepancy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-47380 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB, a platform for building databases as spreadsheets, was found to have a security flaw in its login process. An attacker could determine if a specific email address is registered with the service by measuring how long the system takes to respond to login attempts. This information could be used to target specific users for further attacks or to map out a company's user base.

Technologies: [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-47380 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47380 being exploited in the wild.

**How severe is CVE-2026-47380?** Medium severity, with a CVSS score of 4, published 23 June 2026.

**Which products and versions are affected?** nocodb (npm) < 2026.04.1, ECOSYSTEM:introduced=0,fixed=2026.04.1.

**Is there a fix for CVE-2026-47380?** Yes. nocodb (npm): upgrade to 2026.04.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47380 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47380?** Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nocodb (npm): upgrade to 2026.04.1 or later

  ```sh
  npm install nocodb@2026.04.1
  ```


## Technical details

A timing side-channel vulnerability (CWE-208) exists in NocoDB's authentication service. Prior to version 2026.04.1, the application would return immediately if an email address was not found, but would perform a computationally expensive password hash comparison if the email existed. This discrepancy allows a network-based attacker to enumerate valid users by timing the server's response to unauthenticated sign-in requests. The fix introduces a dummy bcrypt comparison for unknown users to ensure consistent response times. Rate limiting for this endpoint is only available in the Enterprise edition.

## Affected products

- nocodb nocodb < 2026.04.1

## Identifiers

- CVE-2026-47380
- GHSA-jr54-jwhj-55gp

## Timeline

- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD

## References

- [https://github.com/nocodb/nocodb/security/advisories/GHSA-jr54-jwhj-55gp](https://github.com/nocodb/nocodb/security/advisories/GHSA-jr54-jwhj-55gp)

## Related threats

- [NocoDB SSRF in spreadsheet-import endpoint](https://junglewise.ai/threats/cve-2026-53931-nocodb-ssrf-in-spreadsheet-import-endpoint)
- [NocoDB SSRF in base-migration endpoint](https://junglewise.ai/threats/cve-2026-53930-nocodb-ssrf-in-base-migration-endpoint)
- [NocoDB stored cross-site scripting in secure attachments](https://junglewise.ai/threats/cve-2026-53929-nocodb-stored-cross-site-scripting-in-secure-attachments)
- [NocoDB insufficient session expiration in password recovery flow](https://junglewise.ai/threats/cve-2026-53928-nocodb-insufficient-session-expiration-in-password-recovery-flow)
- [NocoDB SSRF in spreadsheet-fetch endpoint](https://junglewise.ai/threats/cve-2026-53927-nocodb-ssrf-in-spreadsheet-fetch-endpoint)