CVE WatchAug 27, 2026

CVE-2026-81335

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name vie

CVSS

7.5

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Aug 27, 2026 · Last modified: Aug 27, 2026 · CWE-862

EPSS · 30d

Not enough EPSS history yet.

Technical description

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py are declared with a permission class that admits any caller, so a request carrying no credential reaches the handler. DataSourceService.dispatch_data_sources in backend/src/baserow/contrib/builder/data_sources/service.py then calls check_multiple_permissions without asking it to raise, and neither stores nor examines the mapping of denials it returns, so a denied check leaves execution to continue and the data source is dispatched whatever the caller's identity. The dispatch runs with the integration's own credentials, so an unauthenticated request naming a data source receives the rows and fields that source reads. Identifiers are small integers and can be enumerated. Version 2.3.1 passes raise_exception to the same call.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-65931—

—

———LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without the expected settings:update privilege. The endpoint also allows the attacker to submit menu IDs that the normal interface and intended update workflow restrict for non-superadministrators, enabling unauthorized changes to administrative navigation records. This issue affects LimeSurvey: 7.0.5.5h CVE-2026-81819—

—

———Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a lower-privileged authenticated user could potentially query another user’s assignment information by supplying that user’s identifier. The fix changes: method_decorators = [api_required] to: method_decorators = [admin_or_org_admin_required, api_required] so only administrators or organization administrators can perform cross-user assignment queries. Version impacted =>3.3.05h CVE-2026-812795.4 MED

—

———Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.8h CVE-2026-812765.3 MED

—

———Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.15h CVE-2026-812745.3 MED

—

———Subscriber Broken Access Control in Ditty <= 3.1.67 versions.12h CVE-2026-812724.9 MED

—

———Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.12h