Unauthenticated Data Source Access in Baserow Application Builder

Baserow version 2.3.0 and earlier contain a critical authorization vulnerability (CVE-2026-81335) within the Application Builder component. The issue stems from the dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py, which are configured with permission classes that do not restrict access to authenticated users. Furthermore, the DataSourceService.dispatch_data_sources function in backend/src/baserow/contrib/builder/data_sources/service.py fails to enforce the results of internal permission checks.

Because the system continues execution regardless of the check result and uses the integration's internal credentials for the data source dispatch, an unauthenticated attacker can retrieve sensitive row and field information. Given that data source identifiers are small, sequential integers, an attacker can trivially enumerate these resources to exfiltrate data from multiple application builders within a target instance. This vulnerability was addressed in version 2.3.1.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass access controls and perform unauthorized data retrieval. By enumerating predictable integer IDs, an attacker can exfiltrate sensitive information from any data source accessible to the integration's internal service account. The impact includes potential large-scale data breach of application builder contents.

Recommendation

• Upgrade all instances of Baserow to version 2.3.1 or higher immediately to apply the fix for CVE-2026-81335.
• Review web server access logs for anomalous, high-frequency GET or POST requests directed at /api/builder/data-sources/ or /api/builder/data-sources/record-name/ endpoints.
• Monitor for requests involving sequential integer IDs in URL parameters or request bodies as indicators of resource enumeration.