CVE-2026-81335
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views are declared with a permission class that admits any caller, and the permission check does not halt execution. An unauthenticated request can receive rows and fields from the data source, and identifiers are small integers that can be enumerated. Version 2.3.1 passes raise_exception to the same call.
Risk Assessment
Unauthorized access to data sources may lead to disclosure of sensitive information stored in Baserow.
Recommendation
Upgrade Baserow to version 2.3.1 or later, which enforces permission checks.
Original NVD description (English source)
Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py are declared with a permission class that admits any caller, so a request carrying no credential reaches the handler. DataSourceService.dispatch_data_sources in backend/src/baserow/contrib/builder/data_sources/service.py then calls check_multiple_permissions without asking it to raise, and neither stores nor examines the mapping of denials it returns, so a denied check leaves execution to continue and the data source is dispatched whatever the caller's identity. The dispatch runs with the integration's own credentials, so an unauthenticated request naming a data source receives the rows and fields that source reads. Identifiers are small integers and can be enumerated. Version 2.3.1 passes raise_exception to the same call.