CVE-2022-22120

5.3 mediumEPSS 1.4%

Medium (5.3) in nocodb nocodb. EPSS 1.4% chance of exploitation in the next 30 days.

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-203
Published: 2022-01-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nocodb:nocodb

References

https://github.com/nocodb/nocodb/commit/f46e89b0
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22120
https://github.com/nocodb/nocodb/commit/f46e89b0
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22120

Check your stack JSON