# CVE-2026-81335: Baserow Application Builder permission bypass in data source dispatch

Source: https://junglewise.ai/threats/cve-2026-81335-baserow-application-builder-permission-bypass-in-data-source  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81335 · Severity: high · CVSS 7.5 · Published 2026-08-27

Baserow is an open-source no-code platform for building databases and applications. An authentication flaw in the Application Builder allows unauthenticated users to access data sources and retrieve sensitive data that should be restricted based on user permissions. Attackers can enumerate data source identifiers and access rows and fields without proper credentials, exposing potentially confidential business information.

Technologies: [Baserow](https://junglewise.ai/threats/technologies/baserow). Vendors: [Baserow](https://junglewise.ai/threats/vendors/baserow).

## Quick answers

**Is CVE-2026-81335 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81335 being exploited in the wild.

**How severe is CVE-2026-81335?** High severity, with a CVSS score of 7.5, published 27 August 2026.

**Which products and versions are affected?** Baserow before 2.3.1.

**Is there a fix for CVE-2026-81335?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-81335 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81335?** Check whether you run Baserow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the Application Builder's data source dispatch mechanism. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py are configured with a permissive permission class that allows unauthenticated callers. The DataSourceService.dispatch_data_sources method calls check_multiple_permissions but fails to pass raise_exception=True and does not examine the returned denial mapping, allowing execution to proceed regardless of permission check results. Since dispatched data sources run with the integration's own credentials, an unauthenticated attacker can request any data source by its integer identifier and receive the associated rows and fields. The fix (version 2.3.1) passes raise_exception to the permission check call, ensuring denied requests are properly rejected.

## Affected products

- Baserow Baserow before 2.3.1

## Timeline

- 2026-08-27: disclosed

## References

- [https://github.com/bram2w/baserow](https://github.com/bram2w/baserow)
- [https://baserow.io/](https://baserow.io/)

## Related threats

- [Baserow missing authorization in unique_row_values endpoint](https://junglewise.ai/threats/cve-2026-113359-baserow-before-2-3-0-contains-a-missing-authorization)
- [Baserow SQL injection in index() formula function](https://junglewise.ai/threats/cve-2026-19754-baserow-sql-injection-in-index-formula-function)
- [Baserow stored XSS via unescaped user display name in mentions](https://junglewise.ai/threats/cve-2026-76837-baserow-stored-xss-via-unescaped-user-display-name-in-mentions)
- [Baserow improper authorization in impersonate endpoint](https://junglewise.ai/threats/cve-2026-18817-baserow-improper-authorization-in-impersonate-endpoint)
- [Baserow 2FA Verify Endpoint improper authentication](https://junglewise.ai/threats/cve-2026-18816-baserow-2fa-verify-endpoint-improper-authentication)