NocoDB has Plaintext Storage of Shared View Passwords
GHSA-mpp2-x7wv-38hv · CVE-2026-28360
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Summary
Shared view passwords were stored in plaintext in the database and compared using direct string equality.
Details
The password column in nc_views stored unhashed passwords. Verification used !== comparison across public-datas.service.ts, public-metas.service.ts, and calendar-datas.service.ts.
Impact
If the database is compromised, shared view passwords are immediately readable. Risk is limited to password reuse scenarios.
Credit
This issue was reported by @Tulgaaaaaaaa.
References
- WEB https://github.com/nocodb/nocodb/security/advisories/GHSA-mpp2-x7wv-38hv
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28360
- WEB https://github.com/nocodb/nocodb/commit/2476df4aed4ae8f6da61612ffe34177364631760
- PACKAGE https://github.com/nocodb/nocodb
- WEB https://github.com/nocodb/nocodb/releases/tag/0.301.3
Ready to move
Start Securing
Free, no credit card | First findings in minutes