CVE-2026-47380
Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison. This vulnerability is fixed in 2026.04.1.
Summary dbcve.org
NocoDB prior to 202.04.1 contained a timing-based user enumeration vulnerability in the sign-in endpoint. The authentication flow for unknown email addresses returned early without performing the computationally expensive password hash comparison, creating a measurable timing difference that allowed attackers to determine which email addresses were registered in the system.
Mitigation
Upgrade to NocoDB version 2026.04.1 or later. This version implements consistent timing in the authentication flow regardless of whether the email exists, eliminating the information leak.