It's a good idea. CBC without verification is vulnerable as well. An attacker can modify the IV and the value will still decrypt. It's quite easy to change a what plaintext will pop out the other side and the client will be none-the-wiser.
Depends on what kinds of data you're encrypting but if its anything to do with money or health data authenticity is a must.
So, when using CBC without verification, attacker with an access to DB won't be able to see original plaintext, but will be able to change the data?
But how can attacker control what plaintext will become, if he doesn't have a key? Wouldn't he be limited to either a random value or a value from another field?
Since IV is constant. It doesn't need to be stored in DB and can be treated like a key. So, attacker (with an access to DB) can't change IV for a server app reading from the DB.
An attacker who has write access to the database and gets feedback if a decryption was successful can still mount the standard padding oracle against CBC, because the first block acts as IV for the second block.
Is authentication needed for field encryption?
EDIT: I should add that is for fields with unique values. So, constant key & IV (per column), but unique data for each field.