Read the docs
TI-2026-76922 Aliases CVE-2026-113359GHSA-fm4f-3f67-2hgv

Missing authorization in Baserow exposes data across workspaces

Priority LOW 24CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Baserow before 2.3.0 contains a missing authorization check in the unique_row_values API endpoint. Any authenticated user can read field values from tables in workspaces they do not belong to by enumerating sequential field IDs, retrieving up to 100 distinct cell values per field. The weakness is classified as CWE-639.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00339 27th percentileScored 2026-11-07
Fix Fixed Baserow (Baserow): 2.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BaserowBaserowbefore 2.3.02.3.0Patch availableCNA
  • Baserow VendorBaserow Affected before 2.3.0 Fixed in 2.3.0 Patch available CNA

Remediation

Upgrade Baserow to version 2.3.0 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Baserow (Baserow) Fixed in 2.3.0

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113359
  2. 2026-10-21 Alias added: GHSA-fm4f-3f67-2hgv
  3. 2026-10-21 CISA SSVC decision points changed

References

Patch 1

Advisory 1

Other 3

  • TI-2026-16020 Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction CVSS 4.0HIGH 8.6
  • TI-2026-56155 Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources CVSS 4.0HIGH 8.7
  • TI-2021-05241 Server-side request forgery in Baserow CVSS 3.1HIGH 7.7
  • TI-2026-53673 Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences