CVE-2026-18816
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Baserow up to version 2.3.2 has a vulnerability in the verify function in views.py of the 2FA Verify Endpoint component, leading to improper authentication. The attack can be launched remotely but has high complexity. The issue is fixed in version 2.3.3.
Risk Assessment
Improper authentication may allow attackers to bypass two-factor mechanisms, increasing the risk of unauthorized account access.
Recommendation
Update Baserow to version 2.3.3 or later, which includes the fix.
Other vulnerabilities in Baserow
See all- CVE-2026-81335High
Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views are declared with a permission class that admits any caller, and the permission check does not halt execution. An unauthenticated request can receive rows and fields from the data source, and identifiers are small integers that can be enumerated. Version 2.3.1 passes raise_exception to the same call.
- CVE-2026-76837Medium
Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first_name value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name into a data-label attribute and the element body unescaped. A name containing a double quote closes that attribute and the opening tag, so following markup lands in the element content. The result is rendered through v-html by the rich-text field components, so any rich-text cell mentioning the account executes the stored script for every workspace member who views the table, without a click. Any workspace member, at the lowest permission level, can set the name and reach every other member of the workspace, and the payload persists until the name is changed or the mentioning row is removed. Version 2.3.0 escapes the value before interpolation.
- CVE-2026-18817Low
Baserow up to version 2.3.2 has an issue in the BaserowImpersonateAuthTokenSerializer function within the Inactive Non-Staff User Handler component, leading to improper authorization. Remote exploitation is possible but requires high complexity. The maintainer suggests it may be more of a bug than a vulnerability, but recommends upgrading to 2.3.3.
Original NVD description (English source)
A vulnerability was identified in Baserow up to 2.3.2. Affected by this vulnerability is the function verify of the file backend/src/baserow/api/two_factor_auth/views.py of the component 2FA Verify Endpoint. Such manipulation leads to improper authentication. The attack may be launched remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. Upgrading to version 2.3.3 addresses this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.