Missing Authorization Vulnerability in Baserow Affects Data Retrieval
CVE-2026-113359

5.3MEDIUM

Key Information:

Vendor

Baserow

Status
Baserow
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113359?

A vulnerability in Baserow prior to version 2.3.0 allows any authenticated user to exploit the unique_row_values API endpoint. This flaw permits unauthorized access to field values from other workspaces. Attackers can enumerate sequential field IDs, enabling them to retrieve up to 100 distinct cell values per field from tables of workspaces they do not have legitimate access to. This poses significant risks to data security and privacy.

Affected Version(s)

Baserow 0 < 2.3.0

References

https://github.com/baserow/baserow/issues/4870
issue-tracking
https://github.com/baserow/baserow/security/advisories/GH...
vendor-advisory
https://github.com/baserow/baserow/commit/6884c1a49adb5eb...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sectum AI
leediay153 from Viettel Post
.