2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28358

CVE-2026-28358: NocoDB: User Enumeration via Password Reset Endpoint

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28358

CVE-2026-28358:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nocodb	npm	<= 0.301.2	0.301.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a user enumeration issue in the password reset functionality of NocoDB. The endpoint POST /api/v2/auth/password/forgot would return different responses depending on whether the email address provided was registered or not, allowing an attacker to build a list of valid user emails.

My analysis began by comparing the vulnerable version 0.301.2 with the patched version 0.301.3. Within the commits between these two tags, I identified the security fix in commit 7d9ba8ccbfc49e2a01b756e9e3988510240d881e, which has the descriptive message: fix(security): return uniform response on password forgot to prevent user enumeration (GHSA-387m).

The patch for this commit modifies the packages/nocodb/src/services/users/users.service.ts file. Specifically, it removes the else block that returned the error message 'Your email has not been registered.'. This change ensures that the endpoint returns a uniform response regardless of whether the user's email exists in the system, thus mitigating the user enumeration vulnerability.

Based on the API endpoint and the context of the fix within the UsersService class, the vulnerable function is identified as UsersService.passwordForgot. During an exploit attempt, this function would be present in runtime profiles and stack traces when a request is made to the password reset endpoint with an unregistered email.

Vulnerable functions

UsersService.passwordForgot

packages/nocodb/src/services/users/users.service.ts

The function `passwordForgot` in `UsersService` was vulnerable to user enumeration. It would return a specific error message, 'Your email has not been registered.', if the provided email did not exist in the database. This allowed an attacker to distinguish between registered and unregistered users by observing the difference in responses from the `/api/v2/auth/password/forgot` endpoint.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.