CVE-2026-19754Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. An authenticated user who can create or edit Formula fields can pass an undocumented fourth argument. Baserow inserts this argument into a PostgreSQL expression. The injected SQL runs with the Baserow database role permissions and can read or modify database data outside the user's workspace permissions.
