CVE-2026-113359: Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-20 · updated 2026-10-21
Weakness: CWE-639

Description

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.

Affected products

Baserow: before 2.3.0 — fixed in 2.3.0

How to fix

Upgrade to a fixed version: Baserow 2.3.0. Check the vendor advisory for mitigations.

References

https://github.com/baserow/baserow/blob/2.2.2/backend/src/baserow/contrib/database/api/fields/views.py
https://github.com/baserow/baserow/commit/6884c1a49adb5eb0a32de1220e6d9f99e9d97c1f
https://github.com/baserow/baserow/issues/4870
https://github.com/baserow/baserow/releases/tag/2.3.0
https://github.com/baserow/baserow/security/advisories/GHSA-r8cf-4rgr-x5cv
https://www.vulncheck.com/advisories/baserow-before-2.3.0-cross-workspace-data-disclosure-via-unique-row-values-endpoint

Get alerted when CVE-2026-113359 or the next vulnerability affects your stack