CVE-2026-18817 Baserow CVE debrief

Who should care

Administrators and users of Baserow up to version 2.3.2 should review and consider upgrading to version 2.3.3 or later. Additionally, security teams and vulnerability management teams should be aware of the potential vulnerability and its impact on their systems. Operators of Baserow installations should also be aware of the potential vulnerability and take necessary precautions to mitigate it.

Technical summary

A potential vulnerability exists in Baserow up to 2.3.2 in the Inactive Non-Staff User Handler component. The issue is related to improper authorization and has a low CVSS score of 2.1. The project maintainer considers it more like a bug than a vulnerability, but will fix it. However, none of the endpoints actually work even though the back gives a token for a deactivated user. The complexity of an attack is rather high, and the exploitation is known to be difficult.

Defensive priority

Low-priority defensive review recommended due to limited evidence and low CVSS score.

Recommended defensive actions

• Review and verify inventory for Baserow installations up to version 2.3.2
• Consider upgrading to Baserow version 2.3.3 or later
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence is limited; primary official records indicate a potential vulnerability in Baserow up to 2.3.2 with uncertain impact. Vendor remediation available in version 2.3.3. The project maintainer considers it more like a bug than a vulnerability, but will fix it. However, none of the endpoints actually work even though the back gives a token for a deactivated user. Further verification is needed to confirm the vulnerability's existence and impact.

Official resources