CVE-2026-18817

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-18817

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18817.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-18817

Published

2026-08-04T22:00:12.012Z

Modified

2026-08-07T03:30:18.272552039Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X CVSS Calculator

Summary

Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization

Details

A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult. The presence of this vulnerability remains uncertain at this time. Upgrading to version 2.3.3 can resolve this issue. The affected component should be upgraded. The project maintainer explains: "While the problem exists, I'm not really sure if it's a vulnerability. (....) Even though the back gives a token for a deactivate user, none of the endpoints actually work. That said, we will fix it, but so far it seems more like a bug instead of a vulnerability."

Database specific

{
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18817.json",
    "isDisputed": true,
    "cwe_ids": [
        "CWE-266",
        "CWE-285"
    ]
}

References

Affected packages

Git / github.com/baserow/baserow

Affected ranges

Type

GIT

Repo

https://github.com/baserow/baserow

Events

Introduced

14b12e4fab015356a69712676e733844dba125bb

Fixed

e5c53c0bf0faf002a5029a369846e761252bb570

Database specific

{
    "extracted_events": [
        {
            "introduced": "2.3.0"
        },
        {
            "last_affected": "2.3.0"
        },
        {
            "introduced": "2.3.1"
        },
        {
            "last_affected": "2.3.1"
        },
        {
            "introduced": "2.3.2"
        },
        {
            "last_affected": "2.3.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.3.0

2.3.1

2.3.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18817.json"