GHSA-r8cf-4rgr-x5cv
Baserow Cross-workspace read of similar field cell values (IDOR) in Baserow
baserow
CVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 2.3.0baserow, baserowGitHub
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Impact
The /api/database/fields/{field_id}/unique_row_values/ (https://api.baserow.io/api/redoc/#tag/Database-table-fields/operation/get_database_field_unique_row_values) endpoint did not contain a permission check. Every authenticated user could obtain the unique values of a specific field without having permissions to the related table.
Patches
Please update to version 2.3.0 or higher.
Reporter
Sectum AI
Text from GitHub Advisory Database
Affected versions 1
- baserow, baserow<=2.2.2GitHub