What is CVE-2026-28358?

CVE-2026-28358 is a medium-severity vulnerability in Nocodb, classified under Observable Response Discrepancy. CVSS score: 5.3/10. Published 2026-03-02.

How severe is CVE-2026-28358?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Nocodb

CVE-2026-28358

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.

EPSS: 0.006 (45.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Nocodb — versions < 0.301.3

Weakness classification (CWE)

CWE-204 — Observable Response Discrepancy

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Product, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2026-28358?: CVE-2026-28358 is a medium-severity vulnerability in Nocodb, classified under Observable Response Discrepancy. CVSS score: 5.3/10. Published 2026-03-02.
How severe is CVE-2026-28358?: Medium severity. CVSS v3 base score is 5.3 out of 10.