CVE-2026-81335

Name of the Vulnerable Software and Affected Versions Baserow versions prior to 2.3.1

Description Baserow fails to act on the result of a permission check when dispatching an Application Builder data source. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data sources/views.py use a permission class that allows any caller, enabling unauthenticated requests to reach the handler. Subsequently, the DataSourceService.dispatch data sources function in backend/src/baserow/contrib/builder/data sources/service.py calls check multiple permissions() without requiring it to raise an exception and ignores the returned mapping of denials. Consequently, the data source is dispatched using the integration's own credentials regardless of the caller's identity, allowing unauthenticated users to retrieve rows and fields by enumerating small integer identifiers.

Recommendations Update to version 2.3.1.