CVE-2026-28396

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28396", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-27T15:33:57.288Z", "datePublished": "2026-03-02T16:18:46.640Z", "dateUpdated": "2026-03-03T15:57:35.051Z"}, "containers": {"cna": {"title": "NocoDB: Refresh Tokens Not Revoked on Password Reset", "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "lang": "en", "description": "CWE-613: Insufficient Session Expiration", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g"}, {"name": "https://github.com/nocodb/nocodb/releases/tag/0.301.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/nocodb/nocodb/releases/tag/0.301.3"}], "affected": [{"vendor": "nocodb", "product": "nocodb", "versions": [{"version": "< 0.301.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-02T16:18:46.640Z"}, "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password. This issue has been patched in version 0.301.3."}], "source": {"advisory": "GHSA-x4vh-j75g-268g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T15:57:16.772830Z", "id": "CVE-2026-28396", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T15:57:35.051Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28396", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-03T15:57:16.772830Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T15:57:30.656Z"}}], "cna": {"title": "NocoDB: Refresh Tokens Not Revoked on Password Reset", "source": {"advisory": "GHSA-x4vh-j75g-268g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "nocodb", "product": "nocodb", "versions": [{"status": "affected", "version": "< 0.301.3"}]}], "references": [{"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g", "name": "https://github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nocodb/nocodb/releases/tag/0.301.3", "name": "https://github.com/nocodb/nocodb/releases/tag/0.301.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password. This issue has been patched in version 0.301.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-02T16:18:46.640Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28396", "state": "PUBLISHED", "dateUpdated": "2026-03-03T15:57:35.051Z", "dateReserved": "2026-02-27T15:33:57.288Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-02T16:18:46.640Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nocodb", "vendor": "nocodb", "versions": [{"status": "affected", "version": "< 0.301.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*", "matchCriteriaId": "4AE4D8D2-EBCC-4E55-8FC1-3353EAB8B008", "versionEndExcluding": "0.301.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password. This issue has been patched in version 0.301.3."}, {"lang": "es", "value": "NocoDB es un software para construir bases de datos como hojas de c\u00e1lculo. Antes de la versi\u00f3n 0.301.3, el flujo de restablecimiento de contrase\u00f1a no revocaba los refresh tokens existentes, permitiendo a un atacante con un refresh token previamente robado continuar generando JWTs v\u00e1lidos despu\u00e9s de que la v\u00edctima restableciera su contrase\u00f1a. Este problema ha sido parcheado en la versi\u00f3n 0.301.3."}], "id": "CVE-2026-28396", "lastModified": "2026-06-17T10:28:32.783", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28396", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T15:57:16.772830Z", "version": "2.0.3"}}]}, "published": "2026-03-02T17:16:34.627", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/nocodb/nocodb/releases/tag/0.301.3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.301.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nocodb", "source": "cna", "vendor": "nocodb"}, "product": "nocodb", "vendor": "nocodb"}], "analysis": {"en": {"generated_at": "2026-04-17T13:33:58.033788+00:00", "value": {"mitigation_remediation": ["Upgrade NocoDB to version 0.301.3 or later, which revokes refresh tokens during password reset.", "After upgrading, force logout for all users or manually invalidate existing refresh tokens to ensure that any tokens issued before the patch are no longer usable.", "Monitor authentication logs for unexpected token usage after password resets and reset passwords or enforce new tokens if suspicious activity is detected."], "summary": {"action": "Apply Patch", "impact": "Token revocation failure allowing continued access after password reset"}, "threat_synthesis": {"affected_systems": "The flaw affects all installations of NocoDB running versions older than 0.301.3, including the latest released versions prior to the patch. Users of any earlier releases are potentially exposed.", "description_and_impact": "The vulnerability arises because the password reset flow does not revoke existing refresh tokens, permitting an attacker who already holds a stolen refresh token to keep minting valid JWTs even after the user changes their password. This flaw creates a persistent, unauthorized access path without requiring further credentials or exploits. It is categorized as CWE\u2011613, a weakness in credential management.", "risk_and_exploitability": "The CVSS score of 4.9 indicates moderate severity. EPSS is reported as less than 1\u202f%, suggesting a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires prior theft of a refresh token; no additional privileges or network access are needed. Once a token is compromised, an attacker can continue generating valid JWTs indefinitely until the password is changed and the token is revoked by the patch."}}}}, "created": "2026-03-03T08:42:46.064352+00:00", "updated": "2026-04-17T13:45:16.020972+00:00", "vendors": ["nocodb", "nocodb$PRODUCT$nocodb"]}