Cyber Resilience

CVE-2026-28358

Low

Published: 02 March 2026

Published
02 March 2026
Modified
03 March 2026
KEV Added
—
Patch
—
CVSS Score v4 2.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0060 69.9th percentile
Risk Priority 6 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-28358 is a low-severity Observable Response Discrepancy (CWE-204) vulnerability in Nocodb Nocodb. Its CVSS base score is 2.7 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Email Addresses (T1589.002); ranked in the top 30.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.

CWE(s)
CWE-204

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1589.002 Email Addresses Reconnaissance
Adversaries may gather email addresses that can be used during targeting.
attack.mitre.org →
Why these techniques?

The response discrepancy directly enables enumeration of valid email addresses/accounts via an exposed endpoint.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

Affected Assets

nocodb
nocodb
≤ 0.301.3

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-30 Concealment and Misdirection
addresses: CWE-204

Fake or randomized responses remove distinguishable success/failure signals attackers rely on.

SI-11 Error Handling
addresses: CWE-204

Eliminates distinguishable response discrepancies in error conditions that could be exploited for reconnaissance.

References