Live › vulnerability › CVE-2026-113359
Go to dashboardBaserow before 2.3.0 lacks an authorization check on the unique_row_values API endpoint. An authenticated user can enumerate sequential field IDs and read up to 100 distinct cell values per field from tables in workspaces they do not belong to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or cloud Baserow instances running a version before 2.3.0 with multiple workspaces, where users in one workspace could hold data from another. Single-workspace instances or instances where all users are trusted have less exposure. The sources do not say whether the flaw depends on any non-default setting.
No product ranges from the sources yet.
baserow --version or the image tag in your deployment; versions below 2.3.0 are affected.2.3.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.
This page as .md · .json · in your agent: get_signal("CVE-2026-113359")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.