CVE-2026-81335

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py are declared with a permission class that admits any caller, so a request carrying no credential reaches the handler. DataSourceService.dispatch_data_sources in backend/src/baserow/contrib/builder/data_sources/service.py then calls check_multiple_permissions without asking it to raise, and neither stores nor examines the mapping of denials it returns, so a denied check leaves execution to continue and the data source is dispatched whatever the caller's identity. The dispatch runs with the integration's own credentials, so an unauthenticated request naming a data source receives the rows and fields that source reads. Identifiers are small integers and can be enumerated. Version 2.3.1 passes raise_exception to the same call.

• CWE-862

• https://baserow.io
• https://github.com/bram2w/baserow
• https://github.com/bram2w/baserow/blob/2.3.0/backend/src/baserow/contrib/builder/data_sources/service.py
• https://github.com/bram2w/baserow/blob/2.3.1/backend/src/baserow/contrib/builder/data_sources/service.py
• https://www.vulncheck.com/advisories/baserow-before-2.3.1-unauthenticated-data-disclosure-via-discarded-permission-check-on-builder-data-sources

Published

Aug 27, 2026

Last Modified

Aug 27, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81320A flaw was found in hawtio-operator. When a custom Route TLS…5.5
• CVE-2026-81322Exposure of Sensitive Information to an Unauthorized Actor v…2.1
• CVE-2026-81326QND uses a hard-coded cryptographic key, which may allow a l…6.8
• CVE-2026-8133A security vulnerability has been detected in zyx0814 FilePr…7.3
• CVE-2026-81330The C6 ear camera transmits live video to the EarVision Andr…6.5
• CVE-2026-81334darknet subscripts its layer array with an index taken from …6.1
• CVE-2026-8134Concrete CMS 9.5.0 and below fails to sanitize path traversa…7.2
• CVE-2026-81341wolfEngine before 1.4.1 sources the explicit AES-CCM nonce f…6.5
• CVE-2026-81342The MasterStudy LMS WordPress Plugin WordPress plugin befor…4.7
• CVE-2026-81346The Frontend Admin by DynamiApps WordPress plugin before 3.2…4.3
• CVE-2026-81347The Frontend Admin by DynamiApps WordPress plugin before 3.2…5.9
• CVE-2026-81348The My Private Site WordPress plugin before 4.2.3 does not …3.7