Quick answers
- Is CVE-2026-18817 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18817 being exploited in the wild.
- How severe is CVE-2026-18817?
- Low severity, with a CVSS score of 2.2, published 4 August 2026.
- Which products and versions are affected?
- Baserow up to 2.3.2.
- Is there a fix for CVE-2026-18817?
- A patch was published on 2026-07-21: Fix released in version 2.3.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-18817 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-18817?
- Check whether you run Baserow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the BaserowImpersonateAuthTokenSerializer component within the admin users serializers module. An attacker with admin privileges can manipulate the serializer to generate authentication tokens for deactivated (non-staff, inactive) users through the admin impersonate endpoint. Although tokens are issued for inactive users, the underlying API endpoints enforce additional authorization checks that prevent token use, significantly limiting exploitation impact. The attack requires admin access and knowledge of the impersonation mechanism. The fix, released in version 2.3.3, prevents impersonation of deactivated users entirely.
Affected products
- Baserow Baserow up to 2.3.2
Timeline
- 2026-08-04: disclosed
- 2026-07-21: patched: Fix released in version 2.3.3