Executive Summary

This vulnerability in NocoDB occurs because the sign-in response timing differs between known and unknown email addresses. Specifically, for unknown email addresses, the system returns a response without performing a password hash comparison, which can allow an attacker to distinguish valid from invalid users based on response time.

This timing difference can be exploited to enumerate valid email addresses in the system, potentially aiding further attacks.

The issue was fixed in version 2026.04.1 of NocoDB.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow attackers to determine which email addresses are registered in the NocoDB system by measuring differences in response times during sign-in attempts.

This user enumeration can lead to targeted attacks such as phishing, credential stuffing, or brute force attacks against known accounts.

While it does not directly allow unauthorized access, it lowers the barrier for attackers to identify valid users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update NocoDB to version 2026.04.1 or later, where the timing difference issue in the sign-in response has been fixed.

Useful 0 Not Useful 0