Quick answers
- Is CVE-2026-18816 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18816 being exploited in the wild.
- How severe is CVE-2026-18816?
- Medium severity, with a CVSS score of 5, published 4 August 2026.
- Which products and versions are affected?
- Baserow up to 2.3.2.
- Is there a fix for CVE-2026-18816?
- A patch was published on 2026: Fixed in version 2.3.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-18816 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-18816?
- Check whether you run Baserow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the 2FA verify endpoint (backend/src/baserow/api/two_factor_auth/views.py) where user identity is resolved from an email field in the request body rather than directly from the 2FA token that already carries the user identity from the login step. This improper authentication flaw allows an attacker to potentially manipulate the email parameter to verify 2FA codes for unauthorized accounts. The attack is network-based but requires high complexity to exploit. The vulnerability was patched in version 2.3.3.
Affected products
- Baserow Baserow up to 2.3.2
Timeline
- 2026-08-04: disclosed
- 2026: patched: Fixed in version 2.3.3