CVE-2026-28358: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28358 is a user enumeration vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. The password forgot endpoint (POST /api/v2/auth/password/forgot) returned different responses for registered versus unregistered email addresses, enabling unauthenticated attackers to determine whether a given email is registered in the system. All NocoDB versions up to and including 0.301.2 are affected; the issue was patched in version 0.301.3, released on February 27, 2026, and publicly disclosed on March 2, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 2.7 (Low) (Github Advisory, NocoDB Advisory).

The root cause is classified as CWE-204 (Observable Response Discrepancy): the application's password reset endpoint revealed internal state by returning a success message for registered emails and the error message 'Your email has not been registered.' for unknown emails. This behavioral difference allows an unauthenticated, remote attacker to systematically probe the endpoint with candidate email addresses and infer which are valid accounts. No authentication, special privileges, or user interaction is required to exploit this flaw. The fix normalizes the API response to return a uniform message regardless of whether the submitted email exists in the system (Github Advisory, NocoDB Advisory).

Successful exploitation allows an unauthenticated attacker to enumerate valid user email addresses registered in a NocoDB instance. No credentials, database contents, or other sensitive data are directly exposed through this vulnerability. However, the enumerated email list can be leveraged for follow-on attacks such as targeted phishing, credential stuffing, brute-force login attempts, or social engineering campaigns against identified users (Github Advisory).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation reported at this time (Github Advisory). The vulnerability is trivially exploitable by any unauthenticated attacker with network access to the NocoDB instance, requiring only the ability to send HTTP POST requests. The EPSS score is approximately 0.042–0.599% (estimates vary by source), indicating a low but non-negligible probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A Nuclei detection template was contributed to the ProjectDiscovery nuclei-templates repository, facilitating automated scanning for this issue (Nuclei Templates).

1. Reconnaissance: Identify internet-facing NocoDB instances (versions ≤ 0.301.2) using search engines like Shodan or Censys, or by directly targeting known NocoDB deployments.
2. Prepare email list: Compile a list of candidate email addresses to test (e.g., common corporate email formats, leaked email lists, or targeted addresses).
3. Send password reset requests: For each candidate email, send an HTTP POST request to the vulnerable endpoint:

   POST /api/v2/auth/password/forgot
   Content-Type: application/json
   
   {"email": "target@example.com"}

4. Analyze responses: Compare the HTTP responses — a success message indicates the email is registered; the response 'Your email has not been registered.' indicates it is not.
5. Build valid user list: Compile all email addresses that returned a success response as confirmed registered accounts for use in subsequent targeted attacks (Github Advisory, NocoDB Advisory).

• Network: High volume of POST requests to /api/v2/auth/password/forgot from a single IP or a distributed set of IPs in a short time window; requests containing varied email addresses in the JSON body.
• Logs: Web server or application access logs showing repeated hits to the password forgot endpoint with different email values, especially from automated tools (e.g., consistent User-Agent strings, rapid sequential requests); HTTP 200 responses mixed with error responses for the same endpoint from the same source.
• Behavioral: Unusual spike in password reset request volume outside of normal business hours or from unexpected geographic locations.

Upgrade NocoDB to version 0.301.3 or later, which returns a uniform response from the password forgot endpoint regardless of whether the submitted email is registered, eliminating the information disclosure (NocoDB Release, Github Advisory). No configuration-based workaround is available for unpatched versions; upgrading is the only remediation. As an additional defensive measure, implement rate limiting on the /api/v2/auth/password/forgot endpoint and review access logs for signs of enumeration activity.

The vulnerability was responsibly reported by researcher @Tulgaaaaaaaa and acknowledged in the NocoDB 0.301.3 release notes, which also credited several other security researchers for disclosing additional issues in the same release (NocoDB Release). A Nuclei detection template was submitted to the ProjectDiscovery community repository, indicating interest from the security scanning community (Nuclei Templates). No significant broader media coverage or notable social media discussion beyond routine CVE tracking has been observed.