NocoDB’s shared-view password check used strict-equality (===) comparison for legacy plaintext passwords prior to version 2026.05.1, leaking the password’s length and per-character prefix through response timing, a type of sensitive information exposure (CWE‑200) and an information‑exposure‑through‑timing flaw (CWE‑203). This plaintext password comparison flaw enables an attacker to infer the password via a remote timing side‑channel and, with iterative attempts, gain unauthorized access to data exposed through the shared view. The vulnerability has been fixed in 2026.05.1.

All installations of NocoDB running a version older than 2026.05.1 are affected. The vulnerability is confined to NocoDB; no other vendors or products are listed as impacted.

The CVSS score of 6.9 places the vulnerability in the moderate risk range. EPSS data is unavailable, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is a remote timing attack against the shared view access interface, requiring only the ability to issue repeated HTTP requests to the protected resource. Successful exploitation would not provide code execution but would allow iterative password brute‑force and subsequent unauthorized data access.