CVE-2026-19754High· 8.6▾ MidnightPoC availableBaserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
0.3% → 0.4%
Last analysed / modified upstream
Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The generated SQL executes through Baserow's database connection with the Baserow PostgreSQL role permissions, allowing data outside the user's workspace permissions to be read or modified.
Baserow >= 2.2.0 <= 2.3.3Upgrade to Baserow 2.3.4 or later. The patch rejects user-supplied four-argument index() formulas and restricts legacy internal SQL templates to an allowlist. Verify the deployed version and run Formula-field regression tests before restoring Formula-field editing permissions.
Until the upgrade is complete, restrict Formula-field creation and modification to trusted users. Identify Formula definitions containing a fourth index() argument, review database activity for unexpected SQL execution, and rotate database credentials if compromise is suspected.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113359Medium· 4.3Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint
CVE-2017-18362Critical· 9.8ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database
CVE-2019-7481High· 7.5Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources
CVE-2017-20252High· 8.2Joomla NextGen Editor 2.1.0 SQL Injection via plname Parameter
CVE-2015-20120High· 8.2RealtyScript 4.0.2 Multiple Time-based Blind SQL Injection
CVE-2019-25778High· 8.2SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter