TrailBase 0.28.2 through 0.35.09 contains an IDOR flaw that lets authenticated users manipulate the object‑store ID stored in std.FileUpload columns without enforcing ownership on insert or update. The attacker can point a record at another user’s file ID to read the victim’s file bytes, or delete or null the victim’s file by modifying their own record. Brute‑force recovery of stripped IDs is possible using a $like filter on the file column. This is a CWE‑639 flaw that violates confidentiality and integrity.

trailbaseio TrailBase versions 0.28.2 up to but not including 0.35.10 are affected. Users should verify that they are not running any of these vulnerable releases.

The CVSS score of 8.6 classifies the issue as high severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. Exploitation requires an authenticated session with write access to the record API; once authenticated, the attacker can assemble a payload that alters the file ID metadata. As the flaw resides in the application logic rather than the underlying storage, the attack vector is likely internal or local, but it can be leveraged from any environment where the application is reachable with user credentials.