https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T16:40:33.871628+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274089 EUVD-2026-274089 2026-10-08T16:40:33.920113+00:00 EUVD-2026-274089 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28358 fkie_cve-2026-28358 2026-10-08T16:40:33.920158+00:00

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.

 https://cve.radiocsirt.org/vuln/ghsa-387m-j3p9-3php GHSA-387m-j3p9-3php — NocoDB Vulnerable to User Enumeration via Password Reset Endpoint 2026-10-08T16:40:33.920194+00:00

Affected: npm: nocodb

### Summary The password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration.

### Details `POST /api/v2/auth/password/forgot` returned a success message for registered emails but `'Your email has not been registered.'` for unknown emails. The fix returns a uniform response regardless of whether the email exists.

### Impact An unauthenticated attacker can determine whether an email is registered. No credentials or data are exposed.

### Credit This issue was reported by [@Tulgaaaaaaaa](https://github.com/Tulgaaaaaaaa).