Budibase

Budibase is affected by multiple vulnerabilities that allow an attacker to gain elevated privileges, bypass security measures, perform SQL injection attacks, or manipulate and disclose data.

An SSRF vulnerability in Budibase backend-core allows authenticated users to bypass blacklist restrictions and perform requests against internal services in the 100.64.0.0/10 address range.

Authenticated administrators can exploit an insecure plugin handling mechanism in Budibase versions prior to 3.41.3 to achieve remote code execution via malicious JavaScript tarball uploads.

An authorization vulnerability in Budibase <= 3.38.1 allows authenticated low-privileged users to generate arbitrary S3 pre-signed upload URLs using server-side datasource credentials.

Budibase versions before 3.40.0 are vulnerable to path traversal via maliciously crafted S3 object keys, allowing authenticated builders to perform arbitrary file writes during workspace export.

Budibase Server versions before 3.40.0 contain a NoSQL injection vulnerability in the MongoDB query execution endpoint, enabling authenticated attackers to bypass filters and perform unauthorized database operations.

Budibase versions prior to 3.40.0 are vulnerable to NoSQL injection in the MongoDB datasource due to improper handling of user-supplied parameters, allowing unauthorized data access and potential server-side execution.

A high-severity NoSQL injection vulnerability in Budibase's MongoDB datasource (npm/@budibase/server <= 3.38.1) allows an authenticated BASIC app user to bypass query-level access controls, enabling full collection dumps, arbitrary JavaScript execution via the MongoDB `$where` operator, cross-collection pivots, and arbitrary update/delete operations due to improper handling of Handlebars-enriched JSON queries.

An unauthenticated attacker can steal REST datasource credentials, including Bearer/Basic tokens and static headers, from Budibase applications due to a critical cross-origin authentication leak (GHSA-mqhr-6j6h-74p5) where the application attaches stored credentials to outgoing requests without validating the destination host, allowing exfiltration to an attacker-controlled server.

A vulnerability in Budibase's MongoDB datasource configuration allows authenticated attackers to specify arbitrary absolute server-side file paths for `tlsCertificateKeyFile` and `tlsCAFile`, enabling the `/api/datasources/verify` endpoint to act as an arbitrary-path existence/read oracle on the underlying multi-tenant server, distinguishing between existing and non-existing files and potentially exfiltrating certificate content.

A regression in Budibase v3.39.4 allows BASIC app users to bypass authorization controls and obtain S3 PutObject presigned URLs, enabling low-privileged users to upload arbitrary content to any S3 bucket that the system's stored IAM credentials can access.

A critical SQL injection vulnerability was discovered in Budibase's MySQL integration (versions <= 3.38.1) that allows remote attackers to execute arbitrary SQL commands through user input fields due to the `multipleStatements: true` configuration, leading to complete database compromise.

A critical vulnerability in Budibase versions up to 3.38.1 allows full account takeover of any existing user, including global administrators, by exploiting a flaw in its OIDC SSO implementation that links incoming identities by email address alone without validating the `email_verified` claim, enabling an attacker to log in as a victim if they can coerce a trusted Identity Provider to assert the victim's email as unverified.

An app-scoped builder in Budibase can exploit a missing authorization flaw in the public role assignment API (`POST /api/public/v1/roles/assign`) to escalate privileges, granting themselves builder access to any other application within the tenant, read/modify data, exfiltrate datasource credentials, and execute arbitrary code via automation steps, compromising the entire tenant's app and data plane in Budibase versions up to and including 3.39.19 and npm/@budibase/server up to 3.38.1.

Multiple vulnerabilities in Budibase allow an attacker to gain elevated privileges, perform SQL injection, bypass security measures, take over user accounts, manipulate or disclose data, and trigger a denial-of-service condition, enabling various malicious activities impacting data integrity, confidentiality, and system availability.

A critical vulnerability, CVE-2026-54352, in Budibase server allows an authenticated workspace builder to perform arbitrary file reads on the host system by uploading a crafted PWA zip file containing a symbolic link, leading to credential compromise and privilege escalation, potentially enabling a full global administrator takeover.

Multiple vulnerabilities in Budibase could be exploited by an attacker to gain administrative privileges, bypass security measures, perform cross-site scripting attacks, manipulate data, or disclose confidential information.

Budibase is vulnerable to persistent stored XSS (CVE-2026-46426) due to unrestricted file upload of active content by authenticated users, leading to potential session cookie theft and account takeover.

A privilege escalation vulnerability exists in Budibase's `onboardUsers` endpoint (CVE-2026-45716) allowing a builder-level user to create global admin accounts by bypassing the intended invite flow when SMTP is not configured, due to insufficient authorization checks and direct user creation with attacker-controlled roles.

An authenticated remote attacker can exploit a vulnerability in Budibase to bypass security measures and manipulate data.

Budibase is vulnerable to server-side request forgery (SSRF) via HTTP redirects in the REST datasource integration, allowing authenticated Builders to bypass IP blacklists and access internal services.

Budibase versions 3.35.3 and earlier are vulnerable to an authentication bypass due to unanchored regular expressions in the public endpoint matcher, allowing unauthenticated attackers to access protected endpoints by manipulating the query string.

The `budibase:auth` cookie in Budibase is set without the `httpOnly` flag, enabling attackers with XSS to steal JWTs and gain persistent access to user accounts.