The password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration.
POST /api/v2/auth/password/forgot returned a success message for registered emails but 'Your email has not been registered.' for unknown emails. The fix returns a uniform response regardless of whether the email exists.
An unauthenticated attacker can determine whether an email is registered. No credentials or data are exposed.
This issue was reported by @Tulgaaaaaaaa.
| Score | Percentile |
|---|---|
| 0.92% | 75.89% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 2.7 | 4.0 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-387m-j3p9-3php ↗ |
| CVE | CVE-2026-28358 ↗ |
| CWE id | Name |
|---|---|
| CWE-204 | Observable Response Discrepancy |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| npm | nocodb | <= 0.301.2 | 0.301.3 | — |