A timing discrepancy in NocoDB’s sign‑in handler allows an attacker to determine whether a given email address is registered on the platform. Prior to 2026.04.1, the unknown‑user branch returned without performing a password hash comparison, creating a measurable difference in response time. This flaw enables an attacker to enumerate valid user accounts and potentially target subsequent credential‑guessing or social‑engineering attacks, but does not directly grant account access or execute code. The weakness is categorized as CWE‑208 and CWE‑307.

The vulnerability affects installations of NocoDB released before 2026.04.1. Users running any older version of the software are exposed until they upgrade to 2026.04.1 or later, which removes the timing difference.

With a CVSS score of 6.3 the flaw is considered moderate in severity. The EPSS value is not available, and the issue is not listed in CISA’s KEV catalog. The attack vector is a network‑based one, exploiting the public sign‑in endpoint; no special privilege or authentication is required. The potential impact lies mainly in privileged disclosure of account existence, which can aid further attacks such as password spraying. The risk is elevated in environments where user enumeration can lead to targeted phishing or credential compromise. However, the flaw does not allow direct compromise of system or data integrity.