Because the system continues execution regardless of the check result and uses the integration's internal credentials for the data source dispatch, an unauthenticated attacker can retrieve sensitive row and field information. Given that data source identifiers are small, sequential integers, an attacker can trivially enumerate these resources to exfiltrate data from multiple application builders within a target instance. This vulnerability was addressed in version 2.3.1.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass access controls and perform unauthorized data retrieval. By enumerating predictable integer IDs, an attacker can exfiltrate sensitive information from any data source accessible to the integration's internal service account. The impact includes potential large-scale data breach of application builder contents.

Recommendation

• Upgrade all instances of Baserow to version 2.3.1 or higher immediately to apply the fix for CVE-2026-81335.
• Review web server access logs for anomalous, high-frequency GET or POST requests directed at /api/builder/data-sources/ or /api/builder/data-sources/record-name/ endpoints.
• Monitor for requests involving sequential integer IDs in URL parameters or request bodies as indicators of resource enumeration.