CVE-2026-113359

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the uniquerowvalues API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in...

CVE-2026-113359 Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the uniquerowvalues API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in...

CVE-2026-113359 Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the uniquerowvalues API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in...

EUVD-2026-105159

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the uniquerowvalues API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in...

CVE-2026-113359

The Baserow application before version 2.3.0 is vulnerable to a missing authorization flaw in the unique_row_values API endpoint. This vulnerability allows any authenticated user to perform a cross-workspace data disclosure by enumerating sequential field IDs. An attacker can successfully retriev...

CVE-2026-103256

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

CVE-2026-103256

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

CVE-2026-103256 n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

CVE-2026-103256

The n8n automation tool (versions before 2.39.6 and 2.40.x before 2.40.1 ) is vulnerable to a credentials leak via a preAuthentication Hook. The flaw resides in the Wekan and Baserow username-and-password credential types, where the application fails to properly validate host fields. Attackers wi...

CVE-2026-103256 n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

EUVD-2026-90650

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

CVE-2026-103256 n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

CVE-2026-103256: Insufficiently Protected Credentials

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

PT-2026-103789

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

CVE-2026-19754

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a...

EUVD-2026-69829

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

CVE-2026-19754 Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a...

CVE-2026-19754

CVE-2026-19754 is a SQL injection vulnerability in Baserow 2.3.3 , specifically in the index() formula function (used for JSONB array extraction). A low-privileged authenticated user who can create or modify formula fields can supply an undocumented fourth argument that is treated as a SQL templa...

CVE-2026-19754 Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a...

CVE-2026-19754 Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a...