CVE-2026-113359
Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.
| CWE | CWE-639 |
| Vendor | baserow |
| Product | baserow |
| Published | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for baserow baserow
Be the first to know when new medium vulnerabilities affecting baserow baserow are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Baserow / Baserow
0 < 2.3.0
References
github.com: https://github.com/baserow/baserow/issues/4870 github.com: https://github.com/baserow/baserow/security/advisories/GHSA-r8cf-4rgr-x5cv github.com: https://github.com/baserow/baserow/commit/6884c1a49adb5eb0a32de1220e6d9f99e9d97c1f github.com: https://github.com/baserow/baserow/releases/tag/2.3.0 github.com: https://github.com/baserow/baserow/blob/2.2.2/backend/src/baserow/contrib/database/api/fields/views.py vulncheck.com: https://www.vulncheck.com/advisories/baserow-before-2.3.0-cross-workspace-data-disclosure-via-unique-row-values-endpoint
Credits
Sectum AI 🔍 leediay153 from Viettel Post