CVE-2026-47380
CVE-2026-47380 · NocoDB: User Enumeration via Sign-In Timing
This page contains facts from public vulnerability sources. Check the original advisory before updating.
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison. This vulnerability is fixed in 2026.04.1.
CVSS 6.3 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node