Vulnerability GHSA-mpp2-x7wv-38hv
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
8 months ago
March 02, 2026 at 07:52 PM UTC
NocoDB has Plaintext Storage of Shared View Passwords
<0.301.3
<0.301.3
Summary
NocoDB has Plaintext Storage of Shared View Passwords
Details
Summary
Shared view passwords were stored in plaintext in the database and compared using direct string equality.
Details
The password column in nc_views stored unhashed passwords. Verification used !== comparison across public-datas.service.ts, public-metas.service.ts, and calendar-datas.service.ts.
Impact
If the database is compromised, shared view passwords are immediately readable. Risk is limited to password reuse scenarios.
Credit
This issue was reported by @Tulgaaaaaaaa.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
4 months ago
NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
<=0.301.3 GHSA-hmcr-rmjq-47qr
<=0.301.3 GHSA-hmcr-rmjq-47qr
Medium Risk
4 months ago
NocoDB: Server-Side Request Forgery via Base Migration URL
<=0.301.3 GHSA-h6vv-pcq8-7xm4
<=0.301.3 GHSA-h6vv-pcq8-7xm4
Medium Risk
4 months ago
NocoDB: Stored Cross-Site Scripting via Secure Attachment
<=0.301.3 GHSA-6mhr-74x2-98v9
<=0.301.3 GHSA-6mhr-74x2-98v9
Medium Risk
4 months ago
NocoDB: Refresh Tokens Persist Through Password Recovery
<=0.301.3 GHSA-r989-7g3j-wjhw
<=0.301.3 GHSA-r989-7g3j-wjhw
Medium Risk
4 months ago
NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
<=0.301.3 GHSA-gprh-27j3-g5h4
<=0.301.3 GHSA-gprh-27j3-g5h4
Impacted packages
Timeline
Published
8 months ago
March 02, 2026 at 07:52 PM UTC
Fixed (0.301.3)
8 months ago
February 27, 2026 at 12:26 PM UTC
Last Modified
9 hours ago
November 05, 2026 at 10:45 PM UTC