# CVE-2026-18816: Baserow 2FA Verify Endpoint improper authentication

Source: https://junglewise.ai/threats/cve-2026-18816-baserow-2fa-verify-endpoint-improper-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18816 · Severity: medium · CVSS 5 · Published 2026-08-04

Baserow is an open-source no-code database platform. A vulnerability in the two-factor authentication verification endpoint allows improper authentication through a flaw in how user identity is resolved during the 2FA process. An attacker could bypass or compromise the 2FA mechanism, potentially gaining unauthorized access to user accounts.

Technologies: [Baserow](https://junglewise.ai/threats/technologies/baserow). Vendors: [Baserow](https://junglewise.ai/threats/vendors/baserow).

## Quick answers

**Is CVE-2026-18816 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18816 being exploited in the wild.

**How severe is CVE-2026-18816?** Medium severity, with a CVSS score of 5, published 4 August 2026.

**Which products and versions are affected?** Baserow up to 2.3.2.

**Is there a fix for CVE-2026-18816?** A patch was published on 2026: Fixed in version 2.3.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18816 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-18816?** Check whether you run Baserow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the 2FA verify endpoint (backend/src/baserow/api/two_factor_auth/views.py) where user identity is resolved from an email field in the request body rather than directly from the 2FA token that already carries the user identity from the login step. This improper authentication flaw allows an attacker to potentially manipulate the email parameter to verify 2FA codes for unauthorized accounts. The attack is network-based but requires high complexity to exploit. The vulnerability was patched in version 2.3.3.

## Affected products

- Baserow Baserow up to 2.3.2

## Timeline

- 2026-08-04: disclosed
- 2026: patched: Fixed in version 2.3.3

## References

- [https://github.com/baserow/baserow/](https://github.com/baserow/baserow/)
- [https://github.com/baserow/baserow/issues/5743](https://github.com/baserow/baserow/issues/5743)

## Related threats

- [Baserow missing authorization in unique_row_values endpoint](https://junglewise.ai/threats/cve-2026-113359-baserow-before-2-3-0-contains-a-missing-authorization)
- [Baserow SQL injection in index() formula function](https://junglewise.ai/threats/cve-2026-19754-baserow-sql-injection-in-index-formula-function)
- [Baserow Application Builder permission bypass in data source dispatch](https://junglewise.ai/threats/cve-2026-81335-baserow-application-builder-permission-bypass-in-data-source)
- [Baserow stored XSS via unescaped user display name in mentions](https://junglewise.ai/threats/cve-2026-76837-baserow-stored-xss-via-unescaped-user-display-name-in-mentions)
- [Baserow improper authorization in impersonate endpoint](https://junglewise.ai/threats/cve-2026-18817-baserow-improper-authorization-in-impersonate-endpoint)