Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-28358 is a user enumeration vulnerability in the NocoDB software versions prior to 0.301.3. The issue occurs in the password reset endpoint, which returns different responses depending on whether the submitted email address is registered or not.'}, {'type': 'paragraph', 'content': 'Specifically, when a user submits a registered email, the endpoint returns a success message, but when an unregistered email is submitted, it returns the message "Your email has not been registered." This difference in responses allows an attacker to determine if an email is registered in the system.'}, {'type': 'paragraph', 'content': 'This vulnerability is classified under CWE-204 (Observable Response Discrepancy) and does not expose any credentials or sensitive data. It was fixed in version 0.301.3 by standardizing the response regardless of email registration status.'}] [2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated attacker to perform user enumeration by distinguishing whether an email address is registered in the NocoDB system.

While no credentials or sensitive data are directly exposed, user enumeration can aid attackers in targeted phishing, social engineering, or brute force attacks by confirming valid user accounts.

The severity of this issue is rated as low.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by observing the responses from the password forgot endpoint at POST /api/v2/auth/password/forgot. Specifically, sending requests with different email addresses and comparing the responses can reveal whether an email is registered or not.'}, {'type': 'list_item', 'content': 'Send a POST request with a registered email and note the response.'}, {'type': 'list_item', 'content': 'Send a POST request with an unregistered email and note the response.'}, {'type': 'list_item', 'content': 'If the responses differ (e.g., success message vs. "Your email has not been registered."), the system is vulnerable to user enumeration.'}, {'type': 'paragraph', 'content': 'Example curl commands to test this behavior:'}, {'type': 'list_item', 'content': 'curl -X POST https://your-nocodb-instance/api/v2/auth/password/forgot -H "Content-Type: application/json" -d \'{"email":"[email protected]"}\''}, {'type': 'list_item', 'content': 'curl -X POST https://your-nocodb-instance/api/v2/auth/password/forgot -H "Content-Type: application/json" -d \'{"email":"[email protected]"}\''}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade NocoDB to version 0.301.3 or later, where this vulnerability has been patched by standardizing the response from the password forgot endpoint regardless of email registration status.

Useful 0 Not Useful 0