CVE-2026-28360

MEDIUM

NocoDB < 0.301.3 - Plaintext Password Storage in Shared View

Title source: llm

Description

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://github.com/nocodb/nocodb/security/advisories/GHSA-mpp2-x7wv-38hv

Release Notes x_refsource_misc

https://github.com/nocodb/nocodb/releases/tag/0.301.3

Scores

CVSS v3 5.3

EPSS 0.0019

EPSS Percentile 9.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-256

Status published

Products (2)

nocodb/nocodb < 0.301.3

npm/nocodb 0 - 0.301.3npm

Published Mar 02, 2026

Tracked Since Mar 03, 2026