CVE-2026-28358

描述

### Summary The password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. ### Details `POST /api/v2/auth/password/forgot` returned a success message for registered emails but `'Your email has not been registered.'` for unknown emails. The fix returns a uniform response regardless of whether the email exists. ### Impact An unauthenticated attacker can determine whether an email is registered. No credentials or data are exposed. ### Credit This issue was reported by [@Tulgaaaaaaaa](https://github.com/Tulgaaaaaaaa).

如何修補 CVE-2026-28358

要修補 CVE-2026-28358,請將受影響套件升級到下列已修補版本。

• —升級至 0.301.3 或更新版本

CVE-2026-28358 正在被利用嗎?

低 — EPSS 為 0.6%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 0.301.3

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-28358
• PATCHgithub.com/nocodb/nocodb
• WEBgithub.com/nocodb/nocodb/releases/tag/0.301.3
• WEBgithub.com/nocodb/nocodb/security/advisories/GHSA-387m-j3p9-3php