CVE-2026-81335

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81335
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81335.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81335
Published
2026-08-27T14:50:42.684Z
Modified
2026-08-29T03:31:00.703840839Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources
Details

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no credential reaches the handler. DataSourceService.dispatchdatasources in backend/src/baserow/contrib/builder/datasources/service.py then calls checkmultiplepermissions without asking it to raise, and neither stores nor examines the mapping of denials it returns, so a denied check leaves execution to continue and the data source is dispatched whatever the caller's identity. The dispatch runs with the integration's own credentials, so an unauthenticated request naming a data source receives the rows and fields that source reads. Identifiers are small integers and can be enumerated. Version 2.3.1 passes raise_exception to the same call.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81335.json",
    "cwe_ids": [
        "CWE-862"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/baserow/baserow

Affected ranges

Type
GIT
Repo
https://github.com/baserow/baserow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
42fec420b6d0266a77e1403036ade3b9a7a3f446
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.1"
        }
    ]
}

Affected versions

0.*
0.0.1
0.0.2
0.1.0
0.2.0
0.3.0
0.3.1
0.4.0
0.5.0
0.6.0
0.7.0
0.7.1
0.8.0
1.*
1.0.0
1.0.1
1.1.0
1.10.0
1.10.1
1.10.2
1.11.0
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.15.2
1.16.0
1.16.1-rc1
1.17.0
1.17.1
1.17.2
1.18.0
1.19.0
1.19.1
1.2.0
1.20.0
1.20.1
1.20.2
1.21.0
1.21.1
1.21.2
1.22.0
1.22.1
1.22.2
1.22.3
1.23.0
1.23.1
1.23.2
1.24.0
1.24.1
1.24.2
1.25.0
1.25.1
1.25.2
1.26.0
1.26.1
1.27.0
1.27.1
1.27.2
1.28.0
1.29.0
1.29.1
1.29.2
1.29.3
1.3.0
1.30.0
1.30.1
1.31.0
1.31.1
1.32.0
1.32.1
1.32.2
1.32.3
1.32.4
1.32.5
1.33.0
1.33.1
1.33.2
1.33.3
1.33.4
1.34.0
1.34.1
1.34.2
1.34.3
1.34.4
1.34.5
1.35.0
1.35.1
1.35.2
1.35.3
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.6.0
1.7.0
1.7.1
1.8.0
1.8.1
1.8.2
1.8.3
1.9
1.9.1
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.1.1
2.1.2
2.1.3
2.1.4
2.1.6
2.2.0
2.2.1
2.2.2
2.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81335.json"