Baserow versions before 2.3.0 contain a missing authorization check that permits any authenticated user to query the unique_row_values API endpoint. This flaw allows an attacker to read cell values belonging to tables in workspaces to which the user does not belong. The vulnerability enables the enumeration of up to 100 distinct values per field, thereby revealing sensitive data that should remain confined to the owning workspace. The impact is a confidentiality breach of cross‑workspace content.

Any deployment of Baserow before release 2.3.0 is affected. The vendor identified in the advisory is Baserow. Versions earlier than 2.3.0 are therefore vulnerable, with the 2.2.x series explicitly mentioned in the references.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local: any authenticated user can exploit the endpoint because no authorization is performed. Once authenticated, the attacker can simply send requests to the unique_row_values endpoint with sequential field identifiers to extract up to 100 cell values per field. No additional privileges or network exposure are required beyond normal authentication.