CVE-2026-113359: Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint

Q: Which deployments are exposed?

Baserow deployments running a version before 2.3.0 are affected. Exploitation requires an authenticated user account; unauthenticated access is not described.

Q: What can an attacker retrieve?

An authenticated attacker can enumerate sequential field IDs through the unique_row_values API endpoint and read field values from tables in workspaces they do not belong to. The endpoint can return up to 100 distinct cell values per field.

Q: Is there evidence of data modification or service disruption?

The provided impact information describes confidentiality exposure only. It does not indicate the ability to modify data or disrupt availability.

Published Oct 20, 2026

Updated

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the uniquerowvalues API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.

Affected Software

1 affected component

Baserow Baserow<2.3.0

Event History

Oct 20, 2026

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Event

via NVD·05:17 PM

Frequently Asked Questions

Which deployments are exposed?

Baserow deployments running a version before 2.3.0 are affected. Exploitation requires an authenticated user account; unauthenticated access is not described.

What can an attacker retrieve?

An authenticated attacker can enumerate sequential field IDs through the unique_row_values API endpoint and read field values from tables in workspaces they do not belong to. The endpoint can return up to 100 distinct cell values per field.

Is there evidence of data modification or service disruption?

The provided impact information describes confidentiality exposure only. It does not indicate the ability to modify data or disrupt availability.

CVE-2026-113359: Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What can an attacker retrieve?

Is there evidence of data modification or service disruption?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What can an attacker retrieve?

Is there evidence of data modification or service disruption?