CVE-2026-47380

Description

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison. This vulnerability is fixed in 2026.04.1.

References

• https://github.com/nocodb/nocodb/security/advisories/GHSA-jr54-jwhj-55gp