{"id":"CVE-2026-28360","aliases":["EUVD-2026-9209","GHSA-mpp2-x7wv-38hv"],"status":"published","title":"NocoDB: Plaintext Storage of Shared View Passwords","description":"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3.","severity":{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00226,"percentile":0.13335,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-256"],"published":"2026-03-02T16:17:36Z","modified":"2026-11-05T22:45:04Z","fixes":[{"ecosystem":"npm","package":"nocodb","fixed_in":["0.301.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nocodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.301.2"},{"fixed":"0.301.3"}]}]},{"source":"osv","ecosystem":"npm","package":"nocodb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.301.3"}]}]}],"products":[{"vendor":"nocodb","product":"nocodb"}],"references":[{"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-mpp2-x7wv-38hv","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/nocodb/nocodb/releases/tag/0.301.3","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28360","tags":["advisory"]},{"url":"https://github.com/nocodb/nocodb/commit/2476df4aed4ae8f6da61612ffe34177364631760","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mpp2-x7wv-38hv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28360.json","tags":["advisory"]},{"url":"https://github.com/nocodb/nocodb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-28360","title":"NocoDB: Plaintext Storage of Shared View Passwords","description":"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3.","status":"published","published":"2026-03-02T16:17:36.693Z","modified":"2026-03-03T16:01:21.017Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T14:20:01.969981Z"}],"euvd":[{"id":"EUVD-2026-9209","description":"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3.","status":"published","published":"2026-03-02T16:17:36Z","modified":"2026-03-03T16:01:21Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T19:48:11.637968Z"}],"ghsa":[{"id":"GHSA-mpp2-x7wv-38hv","title":"NocoDB has Plaintext Storage of Shared View Passwords","description":"### Summary\nShared view passwords were stored in plaintext in the database and compared using direct string equality.\n\n### Details\nThe `password` column in `nc_views` stored unhashed passwords. Verification used `!==` comparison across `public-datas.service.ts`, `public-metas.service.ts`, and `calendar-datas.service.ts`.\n\n### Impact\nIf the database is compromised, shared view passwords are immediately readable. Risk is limited to password reuse scenarios.\n\n### Credit\nThis issue was reported by [@Tulgaaaaaaaa](https://github.com/Tulgaaaaaaaa).","status":"published","published":"2026-03-02T19:52:57Z","modified":"2026-11-05T22:30:10Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-256"],"updated_at":"2026-11-05T22:56:50.456344Z"}],"nvd":[{"id":"CVE-2026-28360","description":"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3.","status":"published","published":"2026-03-02T17:16:34.31Z","modified":"2026-06-17T10:28:28.873Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T14:12:07.420927Z"}],"osv":[{"id":"CVE-2026-28360","title":"NocoDB: Plaintext Storage of Shared View Passwords","description":"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3.","status":"published","published":"2026-03-02T16:17:36.693Z","modified":"2026-10-28T02:30:39.680341967Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"GHSA-mpp2-x7wv-38hv","title":"NocoDB has Plaintext Storage of Shared View Passwords","description":"### Summary\nShared view passwords were stored in plaintext in the database and compared using direct string equality.\n\n### Details\nThe `password` column in `nc_views` stored unhashed passwords. Verification used `!==` comparison across `public-datas.service.ts`, `public-metas.service.ts`, and `calendar-datas.service.ts`.\n\n### Impact\nIf the database is compromised, shared view passwords are immediately readable. Risk is limited to password reuse scenarios.\n\n### Credit\nThis issue was reported by [@Tulgaaaaaaaa](https://github.com/Tulgaaaaaaaa).","status":"published","published":"2026-03-02T19:52:57Z","modified":"2026-11-05T22:45:04.913680275Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-256"],"updated_at":"2026-11-05T23:01:43.138979Z"}]}}