Baserow performs an Application Builder data source dispatch without respecting the outcome of a permission check. Because the permission class for the dispatch and record‑name views allows any caller, an unauthenticated request can reach the handler. The subsequent call to check_multiple_permissions does not raise or store denial information, so a denied check is ignored and the data source is dispatched using the integration's own credentials. This allows an unauthenticated client to retrieve rows and fields that the data source reads, resulting in a breach of confidentiality. The weakness is an access control failure (CWE‑862).

The vulnerability exists in Baserow products running any version prior to 2.3.1, including 2.3.0 and earlier. The issue is tied to the Builder data source dispatch logic in the backend code, so any installation that exposes the Builder API is impacted. Identifiers for data sources are small integers and can be enumerated by a malicious actor.

The CVSS score of 8.7 signals a high severity vulnerability. Exploitation requires only network access to the Builder data source endpoint and does not depend on user authentication; a simple unauthenticated HTTP request can trigger the flaw. Because EPSS is not available and the issue is not listed in the CISA KEV catalog, the exploitation likelihood is uncertain but the potential impact is significant. The attack vector is external and generic, making this a top priority for patching.