Executive brief
Baserow is an open-source no-code database platform. A vulnerability in the two-factor authentication verification endpoint allows improper authentication through a flaw in how user identity is resolved during the 2FA process. An attacker could bypass or compromise the 2FA mechanism, potentially gaining unauthorized access to user accounts.
Technical details
The vulnerability exists in the 2FA verify endpoint (backend/src/baserow/api/two_factor_auth/views.py) where user identity is resolved from an email field in the request body rather than directly from the 2FA token that already carries the user identity from the login step. This improper authentication flaw allows an attacker to potentially manipulate the email parameter to verify 2FA codes for unauthorized accounts. The attack is network-based but requires high complexity to exploit. The vulnerability was patched in version 2.3.3.
Affected products
- Baserow Baserow up to 2.3.2
Timeline
- 2026-08-04: disclosed
- 2026: patched: Fixed in version 2.3.3