CVE-2026-113359

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-113359

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113359.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-113359

Aliases

GHSA-r8cf-4rgr-x5cv

Published

2026-10-20T15:40:23Z

Modified

2026-10-22T02:30:55Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint

Details

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113359.json"
}

References

Affected packages

Git / github.com/baserow/baserow

Affected ranges

Type

GIT

Repo

https://github.com/baserow/baserow

Events

Introduced

Fixed

14b12e4fab015356a69712676e733844dba125bb

Fixed

6884c1a49adb5eb0a32de1220e6d9f99e9d97c1f

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.3.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "6884c1a49adb5eb0a32de1220e6d9f99e9d97c1f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "2.3.0",
            "range":  [
                {
                    "fixed":  "14b12e4fab015356a69712676e733844dba125bb"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.0.1

0.0.2

0.1.0

0.2.0

0.3.0

0.3.1

0.4.0

0.5.0

0.6.0

0.7.0

0.7.1

0.8.0

1.*

1.0.0

1.0.1

1.1.0

1.10.0

1.10.1

1.10.2

1.11.0

1.12.0

1.12.1

1.13.0

1.13.1

1.13.2

1.13.3

1.14.0

1.15.0

1.15.1

1.15.2

1.16.0

1.16.1-rc1

1.17.0

1.17.1

1.17.2

1.18.0

1.19.0

1.19.1

1.2.0

1.20.0

1.20.1

1.20.2

1.21.0

1.21.1

1.21.2

1.22.0

1.22.1

1.22.2

1.22.3

1.23.0

1.23.1

1.23.2

1.24.0

1.24.1

1.24.2

1.25.0

1.25.1

1.25.2

1.26.0

1.26.1

1.27.0

1.27.1

1.27.2

1.28.0

1.29.0

1.29.1

1.29.2

1.29.3

1.3.0

1.30.0

1.30.1

1.31.0

1.31.1

1.32.0

1.32.1

1.32.2

1.32.3

1.32.4

1.32.5

1.33.0

1.33.1

1.33.2

1.33.3

1.33.4

1.34.0

1.34.1

1.34.2

1.34.3

1.34.4

1.34.5

1.35.0

1.35.1

1.35.2

1.35.3

1.4.0

1.4.1

1.4.2

1.4.3

1.5.0

1.6.0

1.7.0

1.7.1

1.8.0

1.8.1

1.8.2

1.8.3

1.9

1.9.1

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.1.1

2.1.2

2.1.3

2.1.4

2.1.6

2.2.0

2.2.1

2.2.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113359.json"