# cve.now: Budibase

The newest entries naming Budibase as an affected vendor (up to 200), of 91 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-103757](https://cve.now/CVE-2026-103757.md): Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation (CVSS 8.3)
- [CVE-2026-100688](https://cve.now/CVE-2026-100688.md): Budibase server before 3.45.0 Cross-Tenant Information Disclosure (CVSS 7.1)
- [CVE-2026-100687](https://cve.now/CVE-2026-100687.md): Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast (CVSS 7.0)
- [CVE-2026-100686](https://cve.now/CVE-2026-100686.md): Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps (CVSS 8.6)
- [CVE-2026-100685](https://cve.now/CVE-2026-100685.md): Budibase before 3.45.0 Information Disclosure via Chat Links (CVSS 8.3)
- [CVE-2026-100684](https://cve.now/CVE-2026-100684.md): Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC (CVSS 9.2)
- [CVE-2026-100683](https://cve.now/CVE-2026-100683.md): Budibase before 3.45.0 SQL Injection via column-rename DDL (CVSS 8.9)
- [CVE-2026-100682](https://cve.now/CVE-2026-100682.md): Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink (CVSS 8.7)
- [CVE-2026-100681](https://cve.now/CVE-2026-100681.md): Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook (CVSS 6.3)
- [CVE-2026-100680](https://cve.now/CVE-2026-100680.md): Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import (CVSS 8.6)
- [CVE-2026-82246](https://cve.now/CVE-2026-82246.md): Budibase Server before 3.41.3 SSRF via Query Import (CVSS 7.1)
- [CVE-2026-82245](https://cve.now/CVE-2026-82245.md): Budibase before 3.41.3 Missing Authorization License Management (CVSS 7.2)
- [CVE-2026-82244](https://cve.now/CVE-2026-82244.md): Budibase before 3.41.3 Remote Code Execution via Plugin eval() (CVSS 9.4)
- [CVE-2026-82243](https://cve.now/CVE-2026-82243.md): Budibase Server before 3.41.3 SSRF with Credential Leakage (CVSS 8.3)
- [CVE-2026-82242](https://cve.now/CVE-2026-82242.md): Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization (CVSS 8.3)
- [CVE-2026-82241](https://cve.now/CVE-2026-82241.md): Budibase backend-core SSRF via incomplete default blacklist (CVSS 7.1)
- [CVE-2026-82240](https://cve.now/CVE-2026-82240.md): Budibase before 3.41.3 Privilege Escalation via User Update API (CVSS 8.6)
- [CVE-2026-82239](https://cve.now/CVE-2026-82239.md): Budibase before 3.41.3 Authorization Bypass via datasources/query (CVSS 8.6)
- [CVE-2026-54356](https://cve.now/CVE-2026-54356.md): Budibase authenticated arbitrary S3 signed upload URL issuance via \`/api/attachments/:datasourceId/url\` (CVSS 7.1)
- [CVE-2026-35219](https://cve.now/CVE-2026-35219.md): Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist (CVSS 7.1)
- [CVE-2026-73410](https://cve.now/CVE-2026-73410.md): Budibase: SSRF via DNS rebinding in the REST datasource integration (CVSS 8.5)
- [CVE-2026-64657](https://cve.now/CVE-2026-64657.md): Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL (CVSS 8.4)
- [CVE-2026-72859](https://cve.now/CVE-2026-72859.md): Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL (CVSS 8.3)
- [CVE-2026-73305](https://cve.now/CVE-2026-73305.md): Budibase: Privilege escalation via public role assignment API missing app-level authorization (CVSS 8.8)
- [CVE-2026-73304](https://cve.now/CVE-2026-73304.md): Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users (CVSS 4.9)
- [CVE-2026-73408](https://cve.now/CVE-2026-73408.md): Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector (CVSS 7.6)
- [CVE-2026-73302](https://cve.now/CVE-2026-73302.md): Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email\_verified (CVSS 9.0)
- [CVE-2026-72857](https://cve.now/CVE-2026-72857.md): Budibase before 3.40.0 Credential Exposure via STRING Fields (CVSS 8.3)
- [CVE-2026-72856](https://cve.now/CVE-2026-72856.md): Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email (CVSS 8.6)
- [CVE-2026-72855](https://cve.now/CVE-2026-72855.md): Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST (CVSS 8.4)
- [CVE-2026-72853](https://cve.now/CVE-2026-72853.md): Budibase before 3.40.0 SQL Injection via Oracle connector (CVSS 8.8)
- [CVE-2026-72851](https://cve.now/CVE-2026-72851.md): Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook (CVSS 9.0)
- [CVE-2026-72850](https://cve.now/CVE-2026-72850.md): Budibase before 3.40.0 Arbitrary File Write via Path Traversal (CVSS 9.4)
- [CVE-2026-72849](https://cve.now/CVE-2026-72849.md): Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF (CVSS 8.7)
- [CVE-2026-73618](https://cve.now/CVE-2026-73618.md): Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter (CVSS 8.7)
- [CVE-2026-73617](https://cve.now/CVE-2026-73617.md): Budibase before 3.40.0 NoSQL Injection via MongoDB datasource (CVSS 7.1)
- [CVE-2026-73409](https://cve.now/CVE-2026-73409.md): Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile (CVSS 5.1)
- [CVE-2026-73407](https://cve.now/CVE-2026-73407.md): Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152)) (CVSS 9.0)
- [CVE-2026-73406](https://cve.now/CVE-2026-73406.md): Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint (CVSS 7.5)
- [CVE-2026-73308](https://cve.now/CVE-2026-73308.md): Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders (CVSS 5.7)
- [CVE-2026-73307](https://cve.now/CVE-2026-73307.md): Budibase: SSRF via bare fetch() in uploadUrl during AI table generation (CVSS 4.9)
- [CVE-2026-73306](https://cve.now/CVE-2026-73306.md): Budibase: Account Enumeration via Login Lockout Response Differential (CVSS 5.3)
- [CVE-2026-73303](https://cve.now/CVE-2026-73303.md): Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) (CVSS 8.2)
- [CVE-2026-73301](https://cve.now/CVE-2026-73301.md): Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings (CVSS 4.3)
- [CVE-2026-73300](https://cve.now/CVE-2026-73300.md): Budibase: SQL Injection via \`multipleStatements: true\` (CVSS 9.6)
- [CVE-2026-67311](https://cve.now/CVE-2026-67311.md): Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect (CVSS 8.2)
- [CVE-2026-54351](https://cve.now/CVE-2026-54351.md): Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override (CVSS 8.2)
- [CVE-2026-54353](https://cve.now/CVE-2026-54353.md): Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation (CVSS 8.5)
- [CVE-2026-54350](https://cve.now/CVE-2026-54350.md): Budibase: Anonymous NoSQL operator injection via published-app query templates (CVSS 10.0)
- [CVE-2026-50137](https://cve.now/CVE-2026-50137.md): Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials (CVSS 8.2)
- [CVE-2026-50136](https://cve.now/CVE-2026-50136.md): Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials (CVSS 7.4)
- [CVE-2026-50132](https://cve.now/CVE-2026-50132.md): Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase (CVSS 7.3)
- [CVE-2026-54352](https://cve.now/CVE-2026-54352.md): Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload (CVSS 9.6)
- [CVE-2026-48147](https://cve.now/CVE-2026-48147.md): Budibase: Unanchored Regex in \`matchers.ts\` Allows CSRF Bypass via Query String Injection in Budibase Worker (CVSS 6.5)
- [CVE-2026-48148](https://cve.now/CVE-2026-48148.md): Budibase: Unvalidated VectorDB Host Parameter Enables SSRF (CVSS 5.3)
- [CVE-2026-45548](https://cve.now/CVE-2026-45548.md): Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation (CVSS 7.7)
- [CVE-2026-45715](https://cve.now/CVE-2026-45715.md): Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration (CVSS 7.7)
- [CVE-2026-45716](https://cve.now/CVE-2026-45716.md): Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration (CVSS 8.8)
- [CVE-2026-45717](https://cve.now/CVE-2026-45717.md): Budibase: \`PUT /api/datasources/:datasourceId\` is protected only by \`TABLE/READ\` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL. (CVSS 8.8)
- [CVE-2026-45718](https://cve.now/CVE-2026-45718.md): Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows (CVSS 5.4)
- [CVE-2026-45719](https://cve.now/CVE-2026-45719.md): Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API (CVSS 6.5)
- [CVE-2026-46425](https://cve.now/CVE-2026-46425.md): Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users (CVSS 9.9)
- [CVE-2026-46424](https://cve.now/CVE-2026-46424.md): Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour (CVSS 4.2)
- [CVE-2026-46426](https://cve.now/CVE-2026-46426.md): Budibase: Unrestricted Upload of File with Dangerous Type (CVSS 7.6)
- [CVE-2026-46427](https://cve.now/CVE-2026-46427.md): Budibase: Snowflake private key returned unmasked from datasource API to BASIC users (CVSS 7.7)
- [CVE-2026-48128](https://cve.now/CVE-2026-48128.md): Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step (CVSS 5.1)
- [CVE-2026-48146](https://cve.now/CVE-2026-48146.md): Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection (CVSS 7.7)
- [CVE-2026-48149](https://cve.now/CVE-2026-48149.md): Budibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypass (CVSS 8.1)
- [CVE-2026-48150](https://cve.now/CVE-2026-48150.md): Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign (CVSS 9.0)
- [CVE-2026-48151](https://cve.now/CVE-2026-48151.md): Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema (CVSS 7.5)
- [CVE-2026-48152](https://cve.now/CVE-2026-48152.md): Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL (CVSS 8.1)
- [CVE-2026-48153](https://cve.now/CVE-2026-48153.md): Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata (CVSS 8.5)
- [CVE-2026-45061](https://cve.now/CVE-2026-45061.md): Budibase: SSRF via trivial \`.tar.gz\` substring bypass in Plugin URL upload (\`/api/plugin\`) (CVSS 7.7)
- [CVE-2026-42239](https://cve.now/CVE-2026-42239.md): Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover (CVSS 8.1)
- [CVE-2026-41428](https://cve.now/CVE-2026-41428.md): Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints (CVSS 9.1)
- [CVE-2026-35218](https://cve.now/CVE-2026-35218.md): Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette (CVSS 8.7)
- [CVE-2026-35216](https://cve.now/CVE-2026-35216.md): Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step (CVSS 9.1)
- [CVE-2026-35214](https://cve.now/CVE-2026-35214.md): Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write (CVSS 8.7)
- [CVE-2026-31818](https://cve.now/CVE-2026-31818.md): Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist (CVSS 9.6)
- [CVE-2026-25044](https://cve.now/CVE-2026-25044.md): Budibase: Command Injection in Bash Automation Step (CVSS 8.7)
- [CVE-2026-25043](https://cve.now/CVE-2026-25043.md): Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding (CVSS 5.3)
- [CVE-2026-33226](https://cve.now/CVE-2026-33226.md): Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview (CVSS 8.7)
- [CVE-2026-31816](https://cve.now/CVE-2026-31816.md): Budibase Universal Auth Bypass via Webhook Query Param Injection (CVSS 9.1)
- [CVE-2026-30240](https://cve.now/CVE-2026-30240.md): Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets (CVSS 9.6)
- [CVE-2026-25045](https://cve.now/CVE-2026-25045.md): Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role) (CVSS 8.7)
- [CVE-2026-25737](https://cve.now/CVE-2026-25737.md): Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS) (CVSS 8.9)
- [CVE-2026-25041](https://cve.now/CVE-2026-25041.md): Budibase has a Command Injection in PostgreSQL Dump Command (CVSS 8.6)
- [CVE-2026-27702](https://cve.now/CVE-2026-27702.md): Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud) (CVSS 9.9)
- [CVE-2026-25040](https://cve.now/CVE-2026-25040.md): Budibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role (CVSS 5.7)
- [CVE-2023-29010](https://cve.now/CVE-2023-29010.md): BudiBase Server-Side Request Forgery vulnerability (CVSS 6.5)
- [CVE-2022-3225](https://cve.now/CVE-2022-3225.md): Improper Control of Dynamically-Managed Code Resources in budibase/budibase (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/budibase
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.