Threats affecting pkg:pypi/baserow

CVE-2026-18817 is a low-severity security issue in Baserow versions 2.3.0 through 2.3.2 involving improper authorization in the BaserowImpersonateAuthTokenSerializer function. The flaw allows token generation for inactive non-staff users, but the project maintainer notes that no endpoints actually work with these tokens, suggesting it is more a bug than a vulnerability. Remote exploitation is possible but considered difficult and of high complexity. Upgrading to version 2.3.3 resolves the issue.

CVE-2026-18816 is an improper authentication vulnerability in Baserow affecting versions 2.3.0, 2.3.1, and 2.3.2. It involves the verify function in the two-factor authentication (2FA) verify endpoint. The vulnerability can be exploited remotely but requires high complexity and is difficult to exploit. The issue is resolved by upgrading to version 2.3.3.