CVE-2026-19754High· 8.6▾ MidnightPoC availableBaserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression.
The vulnerable expression is executed when Baserow recalculates Formula-field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user, allowing data to be read or modified outside the user's workspace permissions.
Baserow >= 2.2.0 <= 2.3.3Upgrade to Baserow 2.4.0 or later. The upstream patch restricts index() to its documented two-argument form and allowlists legacy internal SQL templates. Until the upgrade is complete, restrict Formula-field creation and modification to trusted users, identify Formula definitions containing a fourth index() argument, and review database activity for unexpected SQL execution.
Connected by shared product, vendor, weakness, or advisory.
CVE-2017-18362Critical· 9.8ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database
CVE-2019-7481High· 7.5Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources
CVE-2020-36947High· 7.1LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information
CVE-2021-47763High· 8.2Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries
CVE-2022-50694Critical· 9.8SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x SQL Injection via Username Parameter
CVE-2023-53960Critical· 9.8SOUND4 IMPACT/FIRST/PULSE/Eco v2.x SQL Injection via Authentication Bypass