Baserow CVE-2026-18817

Q: What is the CVSS score of CVE-2026-18817?

CVE-2026-18817 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-52980 LOW

Incorrect Privilege Assignment (CWE-266)

2026-08-04 cna@vuldb.com

GHSA-2h3m-r6q7-49xm

Information Disclosure

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

2.2 LOW

Admin-only endpoint (PR:H) with high-complexity conditions (AC:H); only marginal integrity impact from non-functional token issuance; no confidentiality or availability impact confirmed.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 00:37 vuln.today

Analysis Generated

Aug 05, 2026 - 00:37 vuln.today

DescriptionCVE.org

A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult. The presence of this vulnerability remains uncertain at this time. Upgrading to version 2.3.3 can resolve this issue. The affected component should be upgraded. The project maintainer explains: "While the problem exists, I'm not really sure if it's a vulnerability. (....) Even though the back gives a token for a deactivate user, none of the endpoints actually work. That said, we will fix it, but so far it seems more like a bug instead of a vulnerability."

AnalysisAI

Baserow's admin impersonation endpoint in versions 2.3.0 through 2.3.2 allows authenticated administrators to obtain authentication tokens for deactivated (inactive, non-staff) users via an improper authorization flaw in BaserowImpersonateAuthTokenSerializer. The Baserow maintainer explicitly notes that issued tokens for deactivated accounts are functionally inert because all downstream API endpoints reject them, calling the issue 'more like a bug instead of a vulnerability.' No public exploit code exists, no active exploitation has been observed, and a CVSS 4.0 score of 2.1 reflects the extreme privilege requirement and negligible real-world impact.

Technical ContextAI

Baserow is an open-source, self-hostable no-code database platform similar to Airtable. The vulnerable component is BaserowImpersonateAuthTokenSerializer, located in backend/src/baserow/api/admin/users/serializers.py, which drives the admin user impersonation feature - a capability allowing administrators to authenticate as another user for support and debugging purposes. The CWE-266 (Incorrect Privilege Assignment) root cause indicates the serializer fails to enforce a check for the target user's active status before issuing an impersonation token, generating a valid-looking credential for a deactivated account. The 2.3.3 release notes confirm the fix explicitly: 'Prevent impersonating deactivated users via the admin impersonate endpoint.' Affected versions 2.3.0, 2.3.1, and 2.3.2 are confirmed by EUVD-2026-52980. No CPE strings were provided in the input data.

RemediationAI

Upgrade to Baserow 2.3.3, which explicitly includes the fix 'Prevent impersonating deactivated users via the admin impersonate endpoint' as documented in the release notes at https://github.com/baserow/baserow/releases/tag/2.3.3. If an immediate upgrade is not feasible, restrict network access to the Baserow admin API to trusted management subnets or VPN-only ranges, reducing the pool of actors who can reach the impersonation endpoint even with valid admin credentials - this does not affect normal user-facing operations but adds a network-layer control. A secondary compensating control is auditing admin account inventory and revoking any unnecessary admin roles, since exploitation is entirely gated on PR:H access. Given the maintainer's confirmed statement that deactivated-user tokens are rejected by all downstream endpoints, the functional risk of delaying patching is very low, though upgrading remains the recommended resolution.