CVE-2026-113359 Baserow CVE debrief

Who should care

Defenders responsible for Baserow deployments should assess exposure and implement compensating controls to restrict access to sensitive data. This includes reviewing the current version of Baserow, verifying exposure, and applying patches or upgrades as necessary. Additionally, defenders should monitor for suspicious activity and implement compensating controls to restrict access to sensitive data.

Why it matters

The vulnerability allows authenticated users to read field values from other workspaces, posing a risk to data confidentiality. Defenders should prioritize verifying exposure and implementing compensating controls.

• Authenticated users can access sensitive data from other workspaces
• Data disclosure can occur through enumeration of sequential field IDs
• Compensating controls are necessary to restrict access to sensitive data
• Verification of exposure and remediation efforts are required

Technical summary

The vulnerability allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to. This issue poses a risk to data confidentiality. Defenders should prioritize verifying exposure and implementing compensating controls, as the vulnerability allows authenticated users to read field values from other workspaces without proper authorization.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls, as the vulnerability allows authenticated users to read field values from other workspaces.

Recommended defensive actions

• Verify exposure by checking if Baserow versions before 2.3.0 are in use
• Implement compensating controls to restrict access to sensitive data
• Monitor for suspicious activity on the unique_row_values API endpoint
• Apply the patch or upgrade to Baserow version 2.3.0 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on affected versions and remediation efforts. Defenders should verify exposure and implement compensating controls. The unique_row_values API endpoint allows attackers to enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.