CVE-2026-113359GHSA-r8cf-4rgr-x5cv
Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint
Baserow Baserow
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.3.0BaserowCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.
Text from CVE List
Affected versions 1
- Baserowaffected: all versions before 2.3.0CVE List
References 6
- github.com/baserow/baserow/commit/6884c1a49adb5eb0a32de1220e6d9f99e9d97c1fFixvia CVE List
- github.com/baserow/baserow/releases/tag/2.3.0Fixvia CVE List
- github.com/baserow/baserow/security/advisories/GHSA-r8cf-4rgr-x5cvAdvisoryvia CVE List
- vulncheck.com/advisories/baserow-before-2.3.0-cross-workspace-data-disclosure-via-unique-row-values-endpointAdvisoryvia CVE List
- github.com/baserow/baserow/issues/4870Referencevia CVE List
- github.com/baserow/baserow/blob/2.2.2/backend/src/baserow/contrib/database/api/fields/views.pyReferencevia CVE List