CVE-2026-47380: NocoDB: User Enumeration via Sign-In Timing

June 5, 2026 (updated July 20, 2026)

Sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison.

References

github.com/advisories/GHSA-jr54-jwhj-55gp
github.com/nocodb/nocodb/releases/tag/2026.04.1
github.com/nocodb/nocodb/security/advisories/GHSA-jr54-jwhj-55gp
nvd.nist.gov/vuln/detail/CVE-2026-47380

Code Behaviors & Features

Detect and mitigate CVE-2026-47380 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →