CVE-2026-100688: Authorization Bypass Through User-Controlled Key in budibase server
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrieve sensitive application details including navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers without authorization checks.
AI Analysis
Technical Summary
Budibase server prior to version 3.45.0 contains an authorization bypass vulnerability in the GET /api/applications/:appId/appPackage endpoint. Authenticated users can supply an arbitrary app ID belonging to another tenant and retrieve sensitive application metadata and source code. This flaw enables cross-tenant information disclosure, exposing internal application details including navigation, roles, screen URLs, JavaScript code, and user identifiers without verifying the requesting user's authorization for the targeted tenant's data.
Potential Impact
An attacker with valid authentication can access confidential application data belonging to other tenants, potentially leading to information leakage of internal application structures, user roles, and code. This exposure can facilitate further attacks or unauthorized data access within a multi-tenant environment. However, no evidence of active exploitation is currently known.
Mitigation Recommendations
Upgrade Budibase server to version 3.45.0 or later, where this vulnerability is fixed. Patch status is confirmed by the versioning information indicating the fix in 3.45.0. No alternative mitigations are specified.
CVE-2026-100688: Authorization Bypass Through User-Controlled Key in budibase server
Description
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrieve sensitive application details including navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers without authorization checks.
CVSS v4.0
Score 7.1high
Affected software
budibase
server
pkg:github/budibase/budibaseRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Budibase server prior to version 3.45.0 contains an authorization bypass vulnerability in the GET /api/applications/:appId/appPackage endpoint. Authenticated users can supply an arbitrary app ID belonging to another tenant and retrieve sensitive application metadata and source code. This flaw enables cross-tenant information disclosure, exposing internal application details including navigation, roles, screen URLs, JavaScript code, and user identifiers without verifying the requesting user's authorization for the targeted tenant's data.
Potential Impact
An attacker with valid authentication can access confidential application data belonging to other tenants, potentially leading to information leakage of internal application structures, user roles, and code. This exposure can facilitate further attacks or unauthorized data access within a multi-tenant environment. However, no evidence of active exploitation is currently known.
Mitigation Recommendations
Upgrade Budibase server to version 3.45.0 or later, where this vulnerability is fixed. Patch status is confirmed by the versioning information indicating the fix in 3.45.0. No alternative mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T02:37:41.037Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab7c9abf7a7c5410652fd53
Added to database: 09/26/2026, 13:33:31 UTC
Last enriched: 09/26/2026, 13:47:53 UTC
Last updated: 09/27/2026, 04:31:23 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.