CVE-2026-18817

Received Received - Intake

Improper Authorization in Baserow

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulDB

Description

A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult. The presence of this vulnerability remains uncertain at this time. Upgrading to version 2.3.3 can resolve this issue. The affected component should be upgraded. The project maintainer explains: "While the problem exists, I'm not really sure if it's a vulnerability. (....) Even though the back gives a token for a deactivate user, none of the endpoints actually work. That said, we will fix it, but so far it seems more like a bug instead of a vulnerability."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-18817

Affected Vendors & Products

Vendor	Product	Version / Range
baserow	baserow	to 2.3.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Baserow versions up to 2.3.2, specifically in the function BaserowImpersonateAuthTokenSerializer. It allows improper authorization due to a flaw in handling inactive non-staff user tokens. Exploitation is possible remotely but requires high complexity and is considered difficult. The project maintainer notes uncertainty about whether it qualifies as a vulnerability since endpoints do not function for deactivated users despite token issuance.

Detection Guidance

Detection involves checking the Baserow version installed. If using version 2.3.2 or earlier, the system is potentially vulnerable. Commands like 'pip show baserow' or checking the version in the admin panel can help identify the installed version.

Impact Analysis

The impact is limited due to high attack complexity and difficulty. An attacker could potentially obtain tokens for inactive users, but these tokens would not grant access to functional endpoints. The primary risk is misuse of tokens for inactive accounts, though no confirmed exploitation has been demonstrated.

Compliance Impact

The vulnerability's limited impact and uncertain nature suggest minimal direct compliance risks. However, improper authorization handling could theoretically conflict with principles of least privilege and data protection. No specific compliance violations are confirmed.

Mitigation Strategies

Upgrade Baserow to version 2.3.3 or later immediately. This resolves the issue by addressing the improper authorization flaw in the Inactive Non-Staff User Handler component.

Hi! I’m here to help you understand CVE-2026-18817. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70