CVE-2026-113359
Deferred Deferred - Pending Action

Baserow Missing Authorization Exposes Workspace Data

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113359
EUVD
EUVD-2026-105159

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Baserow Baserow 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in Baserow versions before 2.3.0. It allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint by enumerating sequential field IDs. The endpoint lacked proper permission checks, enabling unauthorized access to up to 100 distinct cell values per field.

Detection Guidance

To detect this vulnerability, check if your Baserow instance is running a version before 2.3.0. Use the API endpoint GET /api/database/fields/{field_id}/unique_row_values/ to test if unauthorized data access is possible. If the endpoint returns field values without proper permission checks, the system is vulnerable.

Impact Analysis

An attacker with access to a workspace could exploit this to read sensitive data from other workspaces they do not belong to. This includes retrieving unique field values, potentially exposing confidential information. The impact is limited to data confidentiality with no direct integrity or availability risks.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating compliance requirements for data protection such as GDPR and HIPAA. It may result in unauthorized access to personal or sensitive health information, leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade Baserow to version 2.3.0 or later immediately. This version includes the necessary permission checks to prevent unauthorized access. If upgrading is not possible, restrict API access or disable the unique_row_values endpoint temporarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113359. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart