CVE-2026-28396
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password. This issue has been patched in version 0.301.3.
- Score
- CVSS 3.1 6.5 Medium
- Status
- Analyzed - security-advisories@github.com
- Published
- 2026-03-02
- Last modified
- 2026-03-03
- Weaknesses
- CWE-613
Affected products
References
- https://github.com/nocodb/nocodb/releases/tag/0.301.3
- https://github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g
