Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck
CVE-2026-113359Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in Baserow from Baserow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 72.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/baserow/baserow/issues/4870 issue-tracking
- GitHub Security Advisory (GHSA-r8cf-4rgr-x5cv) vendor-advisory
- https://github.com/baserow/baserow/commit/6884c1a49adb5eb0a32de1220e6d9f99e9d97c1f patch
- Baserow 2.3.0 Release Notes release-notes
- https://github.com/baserow/baserow/blob/2.2.2/backend/src/baserow/contrib/database/api/fields/views.py technical-description
- VulnCheck Advisory: Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint third-party-advisory