CVE-2026-28396 Details
Description
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password. This issue has been patched in version 0.301.3.
A vulnerability in NocoDB's password reset process prior to version 0.301.3 allowed for the continued use of refresh tokens after a password was changed. The issue arose because the password reset function did not invalidate existing refresh tokens, leaving a window for attackers with stolen tokens to generate valid JSON Web Tokens (JWTs) even after the victim had reset their password.
Users can upgrade to NocoDB version 0.301.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nocodb/nocodb/releases/tag/0.301.3 | [email protected] | ProductRelease Notes |
| https://github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nocodb nocodb | < 0.301.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 3, 2026 | Initial Analysis | [email protected] |
| Mar 2, 2026 | New CVE Received | [email protected] |