CVE-2026-73617 is a NoSQL injection vulnerability affecting Budibase server prior to version 3.40.0. The vulnerability arises from the use of handlebars template processing with noEscaping: true on user-supplied parameters combined with a lack of operator filtering in MongoDB queries. This allows attackers to inject MongoDB operators through query parameters, enabling unauthorized access to data, execution of arbitrary JavaScript code via the $where operator, and modification of database collections through update and delete operations.

An attacker with at least low privileges can exploit this vulnerability to bypass per-user access controls, read arbitrary documents from the database, execute arbitrary JavaScript code on the database server, and perform unauthorized update or delete operations on collections. This can lead to data disclosure, data tampering, and potential compromise of the database integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using vulnerable versions prior to 3.40.0 or implement strict input validation and operator filtering on MongoDB queries to prevent injection. Monitor vendor channels for updates and apply patches once released.