GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-QHXG-623C-CFJM

Vulnerability from github – Published: 2026-06-05 16:03 – Updated: 2026-07-20 21:17
VLAI
Summary
NocoDB: Plaintext Password Comparison in Shared Views
Details

Summary

The shared-view password check fell back to strict-equality (===) comparison for legacy plaintext passwords, leaking the password's length and per-character prefix through response timing.

Details

The bcrypt branch (hashes starting with $2a$/$2b$) was unaffected. The legacy fallback in View.ts now uses crypto.timingSafeEqual and a same-length dummy compare on the length-mismatch path, so total comparison time is approximately length-independent. The EE dashboard model's verifyPassword is patched the same way.

Impact

A network-positioned attacker could mount a timing oracle against shared views whose passwords predated the bcrypt migration. Exploitation requires the ability to time shared-view authentication responses but no prior authentication.

Credit

This issue was reported by @Proscan-one.

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.05.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "nocodb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.05.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47379"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-203"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-05T16:03:33Z",
    "nvd_published_at": "2026-06-23T21:16:59Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe shared-view password check fell back to strict-equality (`===`) comparison for\nlegacy plaintext passwords, leaking the password\u0027s length and per-character prefix\nthrough response timing.\n\n### Details\nThe bcrypt branch (hashes starting with `$2a$`/`$2b$`) was unaffected. The legacy\nfallback in `View.ts` now uses `crypto.timingSafeEqual` and a same-length dummy\ncompare on the length-mismatch path, so total comparison time is approximately\nlength-independent. The EE dashboard model\u0027s `verifyPassword` is patched the same way.\n\n### Impact\nA network-positioned attacker could mount a timing oracle against shared views whose\npasswords predated the bcrypt migration. Exploitation requires the ability to time\nshared-view authentication responses but no prior authentication.\n\n### Credit\nThis issue was reported by [@Proscan-one](https://github.com/Proscan-one).",
  "id": "GHSA-qhxg-623c-cfjm",
  "modified": "2026-07-20T21:17:40Z",
  "published": "2026-06-05T16:03:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-qhxg-623c-cfjm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47379"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nocodb/nocodb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nocodb/nocodb/releases/tag/2026.05.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "NocoDB: Plaintext Password Comparison in Shared Views"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.