Budibase vulnerabilities
91 CVEs and advisories name Budibase as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-72853Budibase before 3.40.0 SQL Injection via Oracle connector
- CVE-2026-72851Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook
- CVE-2026-72850Budibase before 3.40.0 Arbitrary File Write via Path Traversal
- CVE-2026-72849Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF
- CVE-2026-73618Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter
- CVE-2026-73617Budibase before 3.40.0 NoSQL Injection via MongoDB datasource
- CVE-2026-73409Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
- CVE-2026-73407Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))
- CVE-2026-73406Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
- CVE-2026-73308Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
- CVE-2026-73307Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
- CVE-2026-73306Budibase: Account Enumeration via Login Lockout Response Differential
- CVE-2026-73303Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
- CVE-2026-73301Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
- CVE-2026-73300Budibase: SQL Injection via `multipleStatements: true`
- CVE-2026-67311Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect
- CVE-2026-54351Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
- CVE-2026-54353Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation
- CVE-2026-54350Budibase: Anonymous NoSQL operator injection via published-app query templates
- CVE-2026-50137Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
- CVE-2026-50136Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials
- CVE-2026-50132Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase
- CVE-2026-54352Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload
- CVE-2026-48147Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
- CVE-2026-48148Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
- CVE-2026-45548Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
- CVE-2026-45715Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration
- CVE-2026-45716Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
- CVE-2026-45717Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL.
- CVE-2026-45718Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows