Baserow up to version 2.3.2 contains a flaw in the BaserowImpersonateAuthTokenSerializer used by the Inactive Non‑Staff User Handler. The flaw allows an attacker to manipulate the serializer and obtain an authentication token for a deactivated user without the necessary authorization checks, leading to improper authorization that can be leveraged remotely to access endpoints that should be restricted. This weakness is identified as CWE‑266 and CWE‑285. The exploit is considered difficult and has high complexity, but remote exploitation is possible. Based on the description, the likely attack vector is remote manipulation of a REST API endpoint, inferred from the indication of remote exploitation possible.

The vulnerability affects the Baserow product, specifically versions up to 2.3.2. The flaw resides in the backend source file backend/src/baserow/api/admin/users/serializers.py, impacting the Inactive Non‑Staff User Handler component. Upgrading to version 2.3.3 or later removes the issue.

The CVSS score of 2.1 indicates low overall severity; however, the vulnerability is remote and requires high complexity to exploit. EPSS information is not available, and the flaw is not listed in CISA KEV. No public exploit has been reported, and the project maintainer notes uncertainty about the practical impact, describing it more as a bug than a vulnerability. Consequently, the operational risk is currently limited, but patching remains recommended to close any potential authorization gaps.