Budibase vulnerabilities
91 CVEs and advisories name Budibase as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-45719Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
- CVE-2026-46425Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users
- CVE-2026-46424Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour
- CVE-2026-46426Budibase: Unrestricted Upload of File with Dangerous Type
- CVE-2026-46427Budibase: Snowflake private key returned unmasked from datasource API to BASIC users
- CVE-2026-48128Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step
- CVE-2026-48146Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
- CVE-2026-48149Budibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypass
- CVE-2026-48150Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
- CVE-2026-48151Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
- CVE-2026-48152Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
- CVE-2026-48153Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
- CVE-2026-45061Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)
- CVE-2026-42239Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
- CVE-2026-41428Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints
- CVE-2026-35218Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette
- CVE-2026-35216Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
- CVE-2026-35214Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write
- CVE-2026-31818Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
- CVE-2026-25044Budibase: Command Injection in Bash Automation Step
- CVE-2026-25043Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding
- CVE-2026-33226Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview
- CVE-2026-31816Budibase Universal Auth Bypass via Webhook Query Param Injection
- CVE-2026-30240Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets
- CVE-2026-25045Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)
- CVE-2026-25737Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)
- CVE-2026-25041Budibase has a Command Injection in PostgreSQL Dump Command
- CVE-2026-27702Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
- CVE-2026-25040Budibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role
- CVE-2023-29010BudiBase Server-Side Request Forgery vulnerability