CVE-2026-73618 is a NoSQL injection vulnerability affecting Budibase Server prior to version 3.40.0. The flaw arises from improper neutralization of special elements in data query logic, specifically in the MongoDB query execution endpoint. User input is directly interpolated into JSON query templates without adequate sanitization of JSON metacharacters, allowing attackers with query write permissions to inject JSON structural characters. This injection can alter the intended MongoDB queries, enabling unauthorized access to read, modify, or delete arbitrary documents within the database.

Exploitation of this vulnerability allows an attacker with query write permissions to bypass query filters and manipulate MongoDB queries. This can lead to unauthorized disclosure, modification, or deletion of data stored in the Budibase Server database. The CVSS 4.0 score of 8.7 reflects a high severity due to network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict query write permissions to trusted users only and monitor for suspicious query activity. Avoid exposing the MongoDB query execution endpoint to untrusted networks or users.