{"schema":"threatline.record/2","record":{"id":"GHSA-r8cf-4rgr-x5cv","aliases":["GHSA-r8cf-4rgr-x5cv"],"summary":"Baserow Cross-workspace read of similar field cell values (IDOR) in Baserow","details":"### Impact\r\n\r\nThe `/api/database/fields/{field_id}/unique_row_values/` (https://api.baserow.io/api/redoc/#tag/Database-table-fields/operation/get_database_field_unique_row_values) endpoint did not contain a permission check. Every authenticated user could obtain the unique values of a specific field without having permissions to the related table.\r\n\r\n### Patches\r\n\r\nPlease update to version 2.3.0 or higher.\r\n\r\n### Reporter\r\n\r\nSectum AI\r\n","categories":["Unclassified"],"product":"baserow","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/baserow/baserow/security/advisories/GHSA-r8cf-4rgr-x5cv","source_modified_at":"2026-10-15T08:07:55Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"baserow","name":"baserow"},"range":"<=2.2.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/baserow/baserow/security/advisories/GHSA-r8cf-4rgr-x5cv","source_modified_at":"2026-10-15T08:07:55Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"baserow","name":"baserow"},"version":"2.3.0"}],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-15T08:07:55Z","modified_at":"2026-10-15T08:07:55Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/baserow/baserow/security/advisories/GHSA-r8cf-4rgr-x5cv","fetched_at":"2026-10-23T18:58:35.272684Z","source_modified_at":"2026-10-15T08:07:55Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T08:07:55Z","content_hash":"6d3805ec11655fe3568089b3a884dbd3652be787efa9405e58431d4993a784a4"}}