CVE-2026-113359 — Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API e…
Published: 2026-10-20 · CVSS: 5.3 · CVSS 4.0
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7