Skip to content
OpenAdvisories

Vendor

Baserow

5 known vulnerabilities.

Baserow at a glance

Last 12 months
4
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 2 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202610
Aug 202620
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Baserow 5
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 4.3
    CVE-2026-113359

    Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint

    Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distin…

    Baserow Baserow
  • High 8.6
    CVE-2026-19754

    Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

    Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL templ…

    Baserow Baserow
  • High 7.5
    CVE-2026-81335

    Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources

    Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py are declared with a permission class that admits an…

    Baserow Baserow
  • Medium 6.4
    CVE-2026-76837

    Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name

    Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first_name value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with …

    Baserow Baserow
  • High 7.7
    CVE-2021-22255

    SSRF in URL file upload in Baserow <1.1.0 allows remote authenticated users to retrieve files from the internal server …

    Baserow Baserow