Baserow
Monthly
SQL injection in Baserow 2.3.3's index() formula function allows low-privileged authenticated users to supply an undocumented fourth argument that is interpolated directly into a PostgreSQL expression without sanitization. Because formula recalculation runs through Baserow's shared database connection, injected SQL executes with the Baserow PostgreSQL role's privileges - bypassing application-layer access controls and granting read and write access to all database contents reachable by that role. Reported by Fluid Attacks; no public exploit code or CISA KEV active exploitation listing exists at time of analysis.
Unauthenticated data disclosure in Baserow's Application Builder exposes all configured data source records to any caller due to a discarded permission check result. The dispatch and record-name API views accept requests from unauthenticated callers, and the underlying service calls `check_multiple_permissions` without requesting it to raise on denial - the returned denial mapping is silently ignored, allowing execution to proceed and the data source to be dispatched using the integration's own stored credentials. Because data source identifiers are sequential integers, any network-reachable attacker can enumerate all Application Builder data sources and retrieve every row and field they expose. No public exploit has been identified at time of analysis.
Stored cross-site scripting in Baserow's rich-text mention renderer allows any authenticated workspace member - at the lowest permission level - to permanently inject and execute arbitrary scripts in the browsers of all other workspace members who view any table containing a mention of the attacker's account. The attack requires no victim interaction beyond passively loading the table view, and the payload persists until the attacker's display name is corrected or the offending row is deleted. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the zero-click broadcast delivery model makes this operationally more impactful than the CVSS 5.3 base score suggests for multi-tenant Baserow deployments.
SSRF in URL file upload in Baserow <1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over HTTP by inserting an internal address. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
SQL injection in Baserow 2.3.3's index() formula function allows low-privileged authenticated users to supply an undocumented fourth argument that is interpolated directly into a PostgreSQL expression without sanitization. Because formula recalculation runs through Baserow's shared database connection, injected SQL executes with the Baserow PostgreSQL role's privileges - bypassing application-layer access controls and granting read and write access to all database contents reachable by that role. Reported by Fluid Attacks; no public exploit code or CISA KEV active exploitation listing exists at time of analysis.
Unauthenticated data disclosure in Baserow's Application Builder exposes all configured data source records to any caller due to a discarded permission check result. The dispatch and record-name API views accept requests from unauthenticated callers, and the underlying service calls `check_multiple_permissions` without requesting it to raise on denial - the returned denial mapping is silently ignored, allowing execution to proceed and the data source to be dispatched using the integration's own stored credentials. Because data source identifiers are sequential integers, any network-reachable attacker can enumerate all Application Builder data sources and retrieve every row and field they expose. No public exploit has been identified at time of analysis.
Stored cross-site scripting in Baserow's rich-text mention renderer allows any authenticated workspace member - at the lowest permission level - to permanently inject and execute arbitrary scripts in the browsers of all other workspace members who view any table containing a mention of the attacker's account. The attack requires no victim interaction beyond passively loading the table view, and the payload persists until the attacker's display name is corrected or the offending row is deleted. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the zero-click broadcast delivery model makes this operationally more impactful than the CVSS 5.3 base score suggests for multi-tenant Baserow deployments.
SSRF in URL file upload in Baserow <1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over HTTP by inserting an internal address. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.