~ / search / GHSA-mpp2-x7wv-38hv

GHSA-mpp2-x7wv-38hv

NocoDB has Plaintext Storage of Shared View Passwords

Source: GitHub Advisory Database (reviewed) Low CVE-2026-28360

Packages

EcosystemPackageAffectedFixed in
npm nocodb < 0.301.3 0.301.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary Shared view passwords were stored in plaintext in the database and compared using direct string equality. ### Details The `password` column in `nc_views` stored unhashed passwords. Verification used `!==` comparison across `public-datas.service.ts`, `public-metas.service.ts`, and `calendar-datas.service.ts`. ### Impact If the database is compromised, shared view passwords are immediately readable. Risk is limited to password reuse scenarios. ### Credit This issue was reported by [@Tulgaaaaaaaa](https://github.com/Tulgaaaaaaaa).

References

External links from the advisory. They lead to third-party sites.