CVE-2026-81335 Baserow CVE debrief

Who should care

Defenders responsible for Baserow instances, particularly those using the Application Builder feature, should assess exposure and implement compensating controls. This includes verifying the vulnerability, monitoring for suspicious activity, and ensuring that security controls are in place to prevent exploitation. Additionally, security teams and vulnerability management teams should prioritize verifying affected systems and implementing mitigations to to

Why it matters

CVE-2026-81335 is a high-severity vulnerability in Baserow that allows unauthenticated data disclosure via discarded permission checks on Builder data sources. Defenders should prioritize verifying exposure and implementing compensating controls.

• Unauthenticated data disclosure, allowing access to sensitive data.
• Potential enumeration of data source identifiers, which are small integers.
• Lack of authentication and authorization for data source access, allowing unauthorized access.

Technical summary

Baserow dispatches an Application Builder data source without acting on the result of its permission check, allowing unauthenticated requests to access data sources. This occurs because the dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py are declared with a permission class that admits any caller. As a result, a request carrying no credential reaches the handler, and DataSourceService.dispatch_data_sources in backend/src/baserow/contrib/builder/data_sources/service.py calls check_multiple_permissions without asking it to raise, leading to the data source being dispatched regardless of the caller's identity.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls, as the CVE record indicates a high CVSS score of 8.7.

Recommended defensive actions

• Verify exposure by checking if the Baserow instance is vulnerable to unauthenticated data disclosure.
• Implement compensating controls, such as authentication and authorization, for data source access.
• Monitor for suspicious activity and implement logging and auditing to detect potential exploitation.
• Review and update existing security controls to prevent similar vulnerabilities.
• Conduct a thorough risk assessment to identify potential impacts on the organization.
• Develop an incident response plan in case of exploitation.
• Verify the implementation of compensating controls and ensure they are effective.

Evidence notes

The CVE record and source references indicate that Baserow dispatches an Application Builder data source without acting on the result of its permission check, allowing unauthenticated requests to access data sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.