TI-2022-06465 Aliases CVE-2022-22120 GHSA-w7rr-mwmp-rjxv

NocoDB - Observable Discrepancy in the password-reset feature

LOW 27CWE-203Published 2022-01-10 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-203.

Summary

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.

Why it matters now

EPSS 0.01412 72nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nocodb	nocodb	0.9 and later; up to 0.83.8	—	No fix listed	CNA

nocodb Vendornocodb Affected 0.9 and later; up to 0.83.8 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nocodb:nocodb::::::::	0.9 – 0.83.8	Vulnerable	nocodb

cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:* Versions 0.9 – 0.83.8 Vulnerable ·nocodb

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-01-10
nocodb unspecified
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-06466 NocoDB - CSV Injection in User ManagementPriority LOW 37
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-22120
2026-10-03 Alias added: GHSA-w7rr-mwmp-rjxv

References

Exploit 1

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22120

Patch 1

https://github.com/nocodb/nocodb/commit/f46e89b0

TI-2023-17918 NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an… CVSS 3.1HIGH 7.5
TI-2023-27191 NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue CVSS 3.1HIGH 7.6
TI-2026-19968 NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality CVSS 3.1MEDIUM 6.4
TI-2023-04694 Improper Input Validation in nocodb/nocodb CVSS 3.1MEDIUM 6.5
TI-2025-20338 NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page CVSS 3.1MEDIUM 6.1
TI-2023-27663 NocoDB Allows Preview of File with Dangerous Content CVSS 3.1MEDIUM 5.7

See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences