GHSA-jr54-jwhj-55gp CVE-2026-47380
NocoDB: User Enumeration via Sign-In Timing
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.31%
- Chance of exploitation in the next 30 days. Higher than 24.31% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-208 Observable Timing Discrepancy
- CWE-307 Improper Restriction of Excessive Authentication Attempts
- Fix
2026.04.1- Upgrade nocodb to this version or later
Description
Summary
Sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison.
Details
The unknown-user branch in auth.service.ts now performs a bcrypt.compare against
a fixed dummy hash so the response time of failed sign-ins is approximately
independent of whether the address exists. Rate limiting on the sign-in endpoint is
implemented in the Enterprise build only and is not affected by this advisory.
Impact
A network-positioned attacker could enumerate registered email addresses by timing sign-in responses. Exploitation requires only the ability to send unauthenticated sign-in requests.
Credit
This issue was reported by @AndyAnh174.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| nocodb | < 2026.04.1 |
2026.04.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
nocodb npm → 2026.04.1
- npm
npm install nocodb@2026.04.1- yarn
yarn add nocodb@2026.04.1- pnpm
pnpm add nocodb@2026.04.1
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Not defined
- Scope
- X
Weakness
CWE-208: Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
How to prevent it
- Architecture and Design: Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hmcr-rmjq-47qr NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint | Medium | Also affects nocodb |
| GHSA-h6vv-pcq8-7xm4 NocoDB: Server-Side Request Forgery via Base Migration URL | Medium | Also affects nocodb |
| GHSA-6mhr-74x2-98v9 NocoDB: Stored Cross-Site Scripting via Secure Attachment | Medium | Also affects nocodb |
| GHSA-r989-7g3j-wjhw NocoDB: Refresh Tokens Persist Through Password Recovery | Medium | Also affects nocodb |
| GHSA-gprh-27j3-g5h4 NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL | Medium | Also affects nocodb |
| GHSA-g72g-r7m4-9x4g NocoDB: OAuth Tokens Persist Through Security Events | Medium | Also affects nocodb |
| GHSA-xxpj-q764-9r6q NocoDB: Missing Ownership Check in MCP Attachment Read | Low | Also affects nocodb |
| GHSA-hj85-ph9q-78jg NocoDB: Stored Cross-Site Scripting via Form View Redirect URL | High | Also affects nocodb |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor