CVE-2026-18817: Baserow Auth Bypass Vulnerability

CVE-2026-18817 Overview

CVE-2026-18817 is an improper authorization weakness [CWE-266] in Baserow, an open-source no-code database platform. The flaw resides in the BaserowImpersonateAuthTokenSerializer function within backend/src/baserow/api/admin/users/serializers.py, part of the Inactive Non-Staff User Handler component. Baserow versions up to and including 2.3.2 are affected, and the issue is resolved in version 2.3.3. The project maintainer notes that although the backend issues a token for a deactivated user, none of the downstream endpoints function with that token, which limits practical impact. Remote exploitation is theoretically possible but requires high privileges and high attack complexity.

Critical Impact
An authenticated administrator can obtain an impersonation token for a deactivated non-staff user, though downstream endpoints reject that token, limiting real-world exploitation.

Affected Products

Baserow versions up to 2.3.2
Component: Inactive Non-Staff User Handler
File: backend/src/baserow/api/admin/users/serializers.py

Discovery Timeline

2026-08-04 - CVE-2026-18817 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-18817

Vulnerability Analysis

The defect sits in BaserowImpersonateAuthTokenSerializer, the serializer that governs the administrator impersonation feature in Baserow. Impersonation lets an authorized staff user act as another account for support or debugging. The serializer does not correctly reject requests targeting non-staff users whose accounts are deactivated. As a result, the backend returns a valid-looking authentication token for an inactive account when it should refuse the operation outright.

The project maintainer has publicly stated that although a token is issued, no protected endpoint honors it, because downstream authorization checks reject inactive users. This reduces the realistic security impact to a low-integrity information issue rather than an authentication bypass. The weakness is classified as improper privilege management [CWE-266]. The EPSS probability is 0.203%, reflecting a low likelihood of exploitation in the wild.

Root Cause

The root cause is missing validation of the target user's is_active flag inside BaserowImpersonateAuthTokenSerializer before minting a token. The serializer confirms the caller's administrative privilege but does not enforce the state of the impersonation target. This is a business-logic gap in the Inactive Non-Staff User Handler code path.

Attack Vector

Exploitation requires network access to the Baserow admin API and a valid administrator session (PR:H). The attacker submits an impersonation request naming a deactivated non-staff account. The backend responds with an authentication token bound to the inactive user. Because Baserow's endpoints reject tokens for inactive users, the practical impact is limited to a small integrity disclosure rather than account takeover. The public advisory does not include a proof-of-concept, and no verified exploit code is available.

Detection Methods for CVE-2026-18817

Indicators of Compromise

Successful HTTP responses from the Baserow admin impersonation endpoint referencing user IDs that map to is_active = false accounts in the Baserow database.
Audit log entries showing token issuance for deactivated user accounts under /api/admin/users/ impersonation routes.
Unexpected calls to BaserowImpersonateAuthTokenSerializer originating from administrator sessions outside normal support workflows.

Detection Strategies

Correlate Baserow application logs with the user table to flag impersonation tokens issued for accounts where is_active is false.
Alert on any administrator-initiated impersonation activity outside approved change windows or ticket references.
Review reverse-proxy access logs for repeated requests to admin impersonation endpoints from a single administrator identity.

Monitoring Recommendations

Ingest Baserow backend logs into a centralized logging platform and retain administrator API activity for at least 90 days.
Baseline normal impersonation frequency per administrator and alert on statistical deviations.
Monitor for administrator account compromise indicators, since exploitation requires high privileges to begin with.

How to Mitigate CVE-2026-18817

Immediate Actions Required

Upgrade Baserow to version 2.3.3 or later, which resolves the improper authorization check in BaserowImpersonateAuthTokenSerializer.
Audit administrator accounts and remove impersonation privileges from any account that does not require them.
Review existing sessions and revoke tokens issued to deactivated users.

Patch Information

The fix is included in Baserow 2.3.3. Refer to the Baserow 2.3.3 GitHub Release Notes for full change details. Additional advisory context is available at VulDB CVE-2026-18817.

Workarounds

Restrict access to the Baserow admin API through network segmentation or a reverse-proxy allowlist until the upgrade is applied.
Disable or tightly scope administrator accounts that can invoke the impersonation feature.
Deactivate the impersonation workflow at the reverse-proxy layer by blocking requests to the affected admin endpoint.

bash

# Example nginx rule to block the impersonation endpoint until upgrade
location ~* ^/api/admin/users/impersonate {
    deny all;
    return 403;
}