CVE-2026-28360

CVE-2026-28360 · NocoDB: Plaintext Storage of Shared View Passwords

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3.

CVSS 2.7 · Low · EPSS 0.2% · Fix available

Published: 2026-03-02T16:17:36.693Z
Updated: 2026-03-03T16:01:21.017Z

Stack: node

Affected products and versions

nocodb
Versions
- < 0.301.3: Affected
No fix published
nocodb npm
Affected ranges
- SEMVER: < 0.301.3
Update to 0.301.3

Original sources

https://github.com/nocodb/nocodb/security/advisories/GHSA-mpp2-x7wv-38hv
https://github.com/nocodb/nocodb/releases/tag/0.301.3
https://nvd.nist.gov/vuln/detail/CVE-2026-28360

Check your server →

CVE-2026-28360 · NocoDB: Plaintext Storage of Shared View Passwords

Affected products and versions

nocodb

nocodb npm

Original sources