CVE-2026-28360Low▾ SunlitNocoDB has Plaintext Storage of Shared View Passwords
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.2%
Shared view passwords were stored in plaintext in the database and compared using direct string equality.
The password column in nc_views stored unhashed passwords. Verification used !== comparison across public-datas.service.ts, public-metas.service.ts, and calendar-datas.service.ts.
If the database is compromised, shared view passwords are immediately readable. Risk is limited to password reuse scenarios.
This issue was reported by @Tulgaaaaaaaa.
nocodb <= 0.301.2Upgrade to a patched release:
nocodb 0.301.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-28361MediumNocoDB Missing Ownership Validation in MCP Token Operations
CVE-2026-28396MediumNocoDB's Refresh Tokens Not Revoked on Password Reset
CVE-2026-28399MediumNocoDB Vulnerable to SQL Injection via DATEADD Formula
CVE-2026-53927MediumNocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
CVE-2026-53928MediumNocoDB: Refresh Tokens Persist Through Password Recovery
CVE-2026-53929MediumNocoDB: Stored Cross-Site Scripting via Secure Attachment