Shared view passwords were stored in the database as plain text and compared with direct string equality. The vulnerability means that anyone who can read the database can obtain these passwords, and because the passwords are not protected, an attacker can use them to access the associated shared views without modification—leading to unauthorized disclosure of data.

NocoDB versions prior to 0.301.3 are affected. The product vendor is nocodb:nocodb, and the issue exists only for these earlier releases of the software.

The CVSS score of 2.7 indicates low severity, and the EPSS score of less than 1 percent shows a very low likelihood of exploitation. The vulnerability was not listed in the CISA Known Exploited Vulnerabilities catalog, and the problem requires direct database access or the ability to read the stored credentials. The patch was released in version 0.301.3, so the risk is mitigated if the application is updated.