VULNERABILITY INTELLIGENCE
CVE-2026-19754
EPSS probability0.39%
CISA KEVNot currently listed
Published2026-09-02
Last modified2026-10-23
Description
Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The generated SQL executes through Baserow's database connection with the Baserow PostgreSQL role permissions, allowing data outside the user's workspace permissions to be read or modified.
Weakness classification
- help@fluidattacks.com: CWE-89