{"id":"CVE-2026-28360","kind":"vulnerability","aliases":["CVE-2026-28360","GHSA-mpp2-x7wv-38hv"],"related":[],"title":"NocoDB has Plaintext Storage of Shared View Passwords","description":"### Summary\nShared view passwords were stored in plaintext in the database and compared using direct string equality.\n\n### Details\nThe `password` column in `nc_views` stored unhashed passwords. Verification used `!==` comparison across `public-datas.service.ts`, `public-metas.service.ts`, and `calendar-datas.service.ts`.\n\n### Impact\nIf the database is compromised, shared view passwords are immediately readable. Risk is limited to password reuse scenarios.\n\n### Credit\nThis issue was reported by [@Tulgaaaaaaaa](https://github.com/Tulgaaaaaaaa).","summary":"NocoDB stored passwords for shared views unhashed in the nc_views table and compared them with direct string equality. Anyone who can read the database can read those passwords and reuse them where the same password was used elsewhere.","severity":"medium","cvss":5.3,"epss":0.00226,"exploited":false,"exploited_at":null,"products":[{"name":"nocodb","fixed":["0.301.3"],"affected":"<= 0.301.2","ecosystem":"npm"},{"name":"nocodb","fixed":["0.301.3"],"affected":"< 0.301.3","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-256","nocodb","npm","package","self-hosted"],"not_affected_if":["managed-hosting","no-password-on-shared-views"],"how_to_check":"- Check the installed NocoDB version, for example `npm ls nocodb` in the deployment directory, and compare it with the affected range.\n- Look for shared views protected by a password in your NocoDB instance; those passwords are the ones stored in plaintext.","fix":"- `nocodb` upgrade to `0.301.3` or later (npm package, affected up to `0.301.2`).","status":"open","published_at":"2026-03-02T17:16:34+00:00","first_seen_at":"2026-11-05T22:31:37+00:00","triaged_at":"2026-11-05T22:31:46+00:00","updated_at":"2026-11-05T22:46:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T22:31:46Z","model":"claude-haiku-5-5","output":{"fix":"- `nocodb` upgrade to `0.301.3` or later (npm package, affected up to `0.301.2`).","reach":"local","title":"NocoDB: shared view passwords stored in plaintext in the database","impact":"low","summary":"NocoDB stored passwords for shared views unhashed in the nc_views table and compared them with direct string equality. Anyone who can read the database can read those passwords and reuse them where the same password was used elsewhere.","audience":"developers","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","npm"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"database readers obtain shared view passwords in plaintext","analyst_note":"","how_to_check":"- Check the installed NocoDB version, for example `npm ls nocodb` in the deployment directory, and compare it with the affected range.\n- Look for shared views protected by a password in your NocoDB instance; those passwords are the ones stored in plaintext.","plain_action":"","needs_analyst":false,"not_affected_if":["no-password-on-shared-views","managed-hosting"],"who_is_affected":"Teams that self-host NocoDB and protect shared views with a password. The exposure requires access to the database, so instances on managed hosting where the database is not reachable carry less risk. The sources say the main risk is password reuse.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000695,"input_tokens":4424,"output_tokens":506,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,18A '-256':23B '-28360':11A,19A '/tulgaaaaaaaa).':132C '38hv':16A 'across':99C 'anyon':49B 'calendar-datas.service.ts':103C 'column':89C 'compar':43B,81C 'comparison':98C 'compromis':109C 'credit':123C 'cve':9A,17A 'cwe':22B 'databas':54B,79C,107C 'detail':86C 'direct':46B,83C 'elsewher':68B 'equal':48B,85C 'ghsa':13A 'ghsa-mpp2-x7wv-38hv':12A 'github.com':131C 'github.com/tulgaaaaaaaa).':130C 'host':29B 'immedi':114C 'impact':104C 'issu':125C 'limit':118C 'mpp2':14A 'nc':39B,91C 'nocodb':1A,20A,21A,24B,30B 'npm':25B 'packag':26B 'password':8A,32B,58B,65B,72C,88C,95C,112C,120C 'plaintext':3A,76C 'public-datas.service.ts':100C 'public-metas.service.ts':101C 'read':52B,56B 'readabl':115C 'report':127C 'reus':60B,121C 'risk':116C 'scenario':122C 'self':28B 'self-host':27B 'share':6A,34B,70C,110C 'storag':4A 'store':31B,74C,93C 'string':47B,84C 'summari':69C 'tabl':41B 'tulgaaaaaaaa':129C 'unhash':36B,94C 'use':67B,82C,97C 'verif':96C 'view':7A,35B,40B,71C,92C,111C 'x7wv':15A","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host NocoDB and protect shared views with a password. The exposure requires access to the database, so instances on managed hosting where the database is not reachable carry less risk. The sources say the main risk is password reuse.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["nocodb"],"ptokens":["nocodb"],"labels":["cwe256","medium","nocodb","npm","package","selfhosted","vendor"],"campaign_type":null,"first_public_at":"2026-03-02T14:09:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-mpp2-x7wv-38hv","url":"https://github.com/advisories/GHSA-mpp2-x7wv-38hv","severity":"low","published_at":"2026-03-02T19:52:57+00:00","modified_at":"2026-11-05T22:30:10+00:00","first_seen_at":"2026-11-05T22:31:37+00:00","fetched_at":"2026-11-05T22:46:57+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-28360","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28360","severity":null,"published_at":"2026-03-02T17:16:34+00:00","modified_at":"2026-06-17T10:28:28+00:00","first_seen_at":"2026-11-05T22:46:07+00:00","fetched_at":"2026-11-05T22:46:07+00:00","note":null}],"documents":[{"id":80891,"url":"https://api.github.com/repos/nocodb/nocodb/security-advisories/GHSA-mpp2-x7wv-38hv","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":80892,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-mpp2-x7wv-38hv","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-03-02T14:09:20+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":80893,"url":"https://github.com/nocodb/nocodb/releases/tag/0.301.3","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":80894,"url":"https://github.com/nocodb/nocodb/commit/2476df4aed4ae8f6da61612ffe34177364631760","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[{"type":"epss","score":0.00226,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-28360"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}