NOCODB · CVE-2026-28396 · Package
FIX → 0.301.3
NocoDB's password reset invalidated access JWTs but did not delete existing refresh tokens. An attacker holding a previously stolen refresh token can keep minting valid JWTs after the victim resets their password, until that token expires.
first public Mar 2, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
NocoDB instances at version 0.301.2 or earlier are affected. The exposure requires an attacker who has already obtained a refresh token, so teams that never leaked tokens face less risk. Teams that use password reset as a response to a suspected account compromise should treat it as relevant.
Not affected if no-stolen-refresh-tokens, version-0.301.3-or-later
Who cares cwe-613, nocodb, node, self-hosted
nocodb package version in your project, for example with npm ls nocodb.passwordReset path in users.service.ts that does not call UserRefreshToken.deleteAllUserToken().The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.
passwordReset() in users.service.ts updated token_version (invalidating JWTs) but did not call UserRefreshToken.deleteAllUserToken(). The refreshToken() method only checked token existence, not token_version. Both passwordChange() and signOut() correctly deleted all refresh tokens.
An attacker who previously obtained a refresh token retains access after password reset until the token expires.
This issue was reported by @bugbunny-research (bugbunny.ai).
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 0.301.3
nocodb moves to 0.301.3 or later.This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.