---
id: CVE-2026-28360
aliases:
  - GHSA-mpp2-x7wv-38hv
title: NocoDB has Plaintext Storage of Shared View Passwords
summary: NocoDB has Plaintext Storage of Shared View Passwords
severity: low
cwe:
  - CWE-256
vendor: nocodb
product: nocodb
ecosystem: npm
affected:
  - nocodb <= 0.301.2
patched:
  - nocodb 0.301.3
published: '2026-03-02'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:30:10Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-mpp2-x7wv-38hv'
references:
  - url: 'https://github.com/nocodb/nocodb/security/advisories/GHSA-mpp2-x7wv-38hv'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-28360'
  - url: 'https://github.com/nocodb/nocodb/releases/tag/0.301.3'
  - url: >-
      https://github.com/nocodb/nocodb/commit/2476df4aed4ae8f6da61612ffe34177364631760
  - url: 'https://github.com/advisories/GHSA-mpp2-x7wv-38hv'
tags:
  - ghsa
  - npm
epss: 0.00226
epssPercentile: 0.13365
ingestedAt: '2026-11-05T22:38:31.305Z'
---

## Overview

### Summary
Shared view passwords were stored in plaintext in the database and compared using direct string equality.

### Details
The `password` column in `nc_views` stored unhashed passwords. Verification used `!==` comparison across `public-datas.service.ts`, `public-metas.service.ts`, and `calendar-datas.service.ts`.

### Impact
If the database is compromised, shared view passwords are immediately readable. Risk is limited to password reuse scenarios.

### Credit
This issue was reported by [@Tulgaaaaaaaa](https://github.com/Tulgaaaaaaaa).

## Affected packages

- `nocodb <= 0.301.2`

## Remediation

Upgrade to a patched release:

- `nocodb 0.301.3`