{"id":"CVE-2026-113359","kind":"vulnerability","aliases":["CVE-2026-113359"],"related":[],"title":"Baserow: any logged-in user can read cells from other workspaces","description":"Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.","summary":"Baserow before 2.3.0 lacks an authorization check on the unique_row_values API endpoint. An authenticated user can enumerate sequential field IDs and read up to 100 distinct cell values per field from tables in workspaces they do not belong to.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["baserow","multi-workspace","package","self-hosted"],"not_affected_if":["single-workspace-trusted-users","version-2.3.0-or-later"],"how_to_check":"- Check the installed Baserow version: `baserow --version` or the image tag in your deployment; versions below `2.3.0` are affected.\n- Confirm the endpoint is reachable by an ordinary account on your instance, since the sources describe any authenticated user as able to call it.","fix":"- Upgrade Baserow to `2.3.0` or later.\n- Until upgraded, restrict who can create or log into accounts on the instance.","status":"open","published_at":"2026-10-20T16:17:06+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:24:42+00:00","updated_at":"2026-10-25T04:24:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:24:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Baserow to `2.3.0` or later.\n- Until upgraded, restrict who can create or log into accounts on the instance.","reach":"internet","title":"Baserow: any logged-in user can read cells from other workspaces","impact":"medium","summary":"Baserow before 2.3.0 lacks an authorization check on the unique_row_values API endpoint. An authenticated user can enumerate sequential field IDs and read up to 100 distinct cell values per field from tables in workspaces they do not belong to.","category":"package","nicknames":[],"who_cares":["baserow","self-hosted","multi-workspace"],"confidence":0.7,"needs_auth":"yes","worst_case":"Any logged-in user reads cell values from other workspaces' tables","analyst_note":"","how_to_check":"- Check the installed Baserow version: `baserow --version` or the image tag in your deployment; versions below `2.3.0` are affected.\n- Confirm the endpoint is reachable by an ordinary account on your instance, since the sources describe any authenticated user as able to call it.","needs_analyst":false,"not_affected_if":["version-2.3.0-or-later","single-workspace-trusted-users"],"who_is_affected":"Self-hosted or cloud Baserow instances running a version before 2.3.0 with multiple workspaces, where users in one workspace could hold data from another. Single-workspace instances or instances where all users are trusted have less exposure. The sources do not say whether the flaw depends on any non-default setting.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000612,"input_tokens":3325,"output_tokens":558,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113359':15A,18A '-2026':14A,17A '100':53B,104C '2.3.0':29B,69C 'allow':76C 'api':39B,92C 'attack':94C 'authent':42B,78C 'author':32B,73C 'baserow':1A,19B,27B,67C 'belong':66B,117C 'cell':9A,55B,106C 'check':33B 'contain':70C 'cve':13A,16A 'distinct':54B,105C 'endpoint':40B,93C 'enumer':45B,96C 'field':47B,58B,82C,98C,109C 'host':26B 'id':48B,99C 'lack':30B 'log':4A 'logged-in':3A 'miss':72C 'multi':21B 'multi-workspac':20B 'packag':23B 'per':57B,108C 'read':8A,50B,81C 'retriev':101C 'row':37B,90C 'self':25B 'self-host':24B 'sequenti':46B,97C 'tabl':60B,111C 'uniqu':36B,89C 'user':6A,43B,79C 'valu':38B,56B,83C,91C,107C 'via':87C 'vulner':74C 'workspac':12A,22B,62B,86C,113C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or cloud Baserow instances running a version before 2.3.0 with multiple workspaces, where users in one workspace could hold data from another. Single-workspace instances or instances where all users are trusted have less exposure. The sources do not say whether the flaw depends on any non-default setting.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113359","severity":null,"published_at":"2026-10-20T16:17:06+00:00","modified_at":"2026-10-21T16:17:22+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}