The vulnerability enables attackers to determine whether an email address is associated with a NocoDB account by observing distinct responses from the password‑reset endpoint. This enumeration capability exposes user identities, which can be a stepping stone to social‑engineering attacks or tailored information‑exposure attempts. The weakness is classified as CWE‑204, which deals with logical flaws that allow information leakage.

NocoDB, any installation running a version older than 0.301.3. The affected product is the entire NocoDB application, regardless of deployment size, as the flaw exists in the core password‑reset functionality.

The CVSS score is 2.7, indicating low overall severity. The EPSS score is below 1 %, suggesting a very low probability of exploitation at the time of analysis, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be remote over the web, as the password‑reset endpoint is publicly accessible; an attacker would simply send POST requests with arbitrary email addresses and observe the differing responses. This does not require authentication or privileged access, making the flaw broadly exploitable by any Internet user.