{"id":"CVE-2026-28360","aliases":["GHSA-mpp2-x7wv-38hv"],"title":"NocoDB has Plaintext Storage of Shared View Passwords","summary":"NocoDB has Plaintext Storage of Shared View Passwords","severity":"low","cwe":["CWE-256"],"vendor":"nocodb","product":"nocodb","ecosystem":"npm","affected":["nocodb <= 0.301.2"],"patched":["nocodb 0.301.3"],"published":"2026-03-02","updated":"2026-11-05","sourceUpdated":"2026-11-05T22:30:10Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-mpp2-x7wv-38hv","references":[{"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-mpp2-x7wv-38hv"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28360"},{"url":"https://github.com/nocodb/nocodb/releases/tag/0.301.3"},{"url":"https://github.com/nocodb/nocodb/commit/2476df4aed4ae8f6da61612ffe34177364631760"},{"url":"https://github.com/advisories/GHSA-mpp2-x7wv-38hv"}],"tags":["ghsa","npm"],"epss":0.00226,"epssPercentile":0.13365,"ingestedAt":"2026-11-05T22:38:31.305Z","slug":"CVE-2026-28360","body":"## Overview\n\n### Summary\nShared view passwords were stored in plaintext in the database and compared using direct string equality.\n\n### Details\nThe `password` column in `nc_views` stored unhashed passwords. Verification used `!==` comparison across `public-datas.service.ts`, `public-metas.service.ts`, and `calendar-datas.service.ts`.\n\n### Impact\nIf the database is compromised, shared view passwords are immediately readable. Risk is limited to password reuse scenarios.\n\n### Credit\nThis issue was reported by [@Tulgaaaaaaaa](https://github.com/Tulgaaaaaaaa).\n\n## Affected packages\n\n- `nocodb <= 0.301.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nocodb 0.301.3`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}