CVE-2026-19754 | BDVDB-2026-367276 Detail

Description#

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The generated SQL executes through Baserow's database connection with the Baserow PostgreSQL role permissions, allowing data outside the user's workspace permissions to be read or modified.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-02Record published in the CVE List.
2. Version 22026-10-23Most recent update recorded in the CVE List.