{"id":12168,"date":"2026-09-04T18:54:09","date_gmt":"2026-09-04T10:54:09","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-81335"},"modified":"2026-09-04T18:54:09","modified_gmt":"2026-09-04T10:54:09","slug":"cve-2026-81335","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-81335","title":{"rendered":"CVE-2026-81335 [HIGH] &#8211; Baserow dispatches an Application Builder data source without acting on the result of its"},"content":{"rendered":"<p>Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend\/src\/baserow\/contrib\/builder\/api\/data_sources\/views.py are declared with a permission class that admits any caller, so a request carrying no credential reaches the handler. DataSourceService.dispatch_data_sources in backend\/src\/baserow\/contrib\/builder\/data_sources\/service.py then calls check_multiple_permissions without asking it to raise, and neither stores nor examines the mapping of denials it returns, so a denied check leaves execution to continue and the data source is dispatched whatever the caller&#8217;s identity. The dispatch runs with the integration&#8217;s own credentials, so an unauthenticated request naming a data source receives the rows and fields that source reads. Identifiers are small integers and can be enumerated. Version 2.3.1 passes raise_exception to the same call.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend\/src\/baserow\/contrib\/builder\/api\/data_sources\/v<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12168","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}