{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/budibase-server/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-73618"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Budibase Server"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","nosql-injection","database-security"],"_cs_type":"advisory","_cs_vendors":["Budibase"],"content_html":"\u003cp\u003eBudibase Server versions prior to 3.40.0 contain a critical NoSQL injection vulnerability within the MongoDB query execution component. The flaw arises from improper sanitization of user-supplied parameters that are interpolated into JSON query templates. An attacker with query write permissions can inject malicious JSON structural characters, such as curly braces or operator keys (e.g., $gt, $ne), to manipulate the underlying database queries. By subverting these query structures, an adversary can bypass application-level access controls to perform unauthorized operations, including reading sensitive records, modifying existing documents, or deleting data from the database. This vulnerability poses a significant risk to data integrity and confidentiality for deployments of Budibase Server versions below 3.40.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers with standard query write privileges to escalate their access to sensitive database contents. This can lead to full data exfiltration, unauthorized modification of application state, or destructive database operations, impacting the overall security of the Budibase instance and any business-critical data processed by the platform.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Budibase Server to version 3.40.0 or later immediately to apply the vendor-provided sanitization fix for MongoDB query templates.\u003c/li\u003e\n\u003cli\u003eAudit access control logs to identify accounts with query write permissions that have exhibited unusual request patterns or attempted injection of JSON operators.\u003c/li\u003e\n\u003cli\u003eMonitor database access logs for high volumes of document modification or deletion commands emanating from the Budibase application service account.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-13T12:57:08Z","date_published":"2026-08-13T12:57:08Z","id":"https://feed.craftedsignal.io/briefs/2026-08-budibase-nosql/","summary":"Budibase Server versions before 3.40.0 contain a NoSQL injection vulnerability in the MongoDB query execution endpoint, enabling authenticated attackers to bypass filters and perform unauthorized database operations.","title":"NoSQL Injection in Budibase Server","url":"https://feed.craftedsignal.io/briefs/2026-08-budibase-nosql/"}],"language":"en","title":"CraftedSignal Threat Feed - Budibase Server","version":"https://jsonfeed.org/version/1.1"}