medium6.3
CVE-2026-47380
NocoDB is software for building databases as spreadsheets.
Impact
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison. This vulnerability is fixed in 2026.04.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | nocodb | < 2026.04.1 | 2026.04.1 |