The vulnerability in Budibase server (<= 3.39.0) occurs because the function enrichContext directly substitutes user-supplied parameters into raw JSON query bodies without JSON string escaping, followed by JSON.parse, which allows attacker-controlled fields to be injected into NoSQL query filters. The input validation only blocks Handlebars markers but does not prevent JSON metacharacters, enabling injection of NoSQL operators. The queries with role PUBLIC bypass authentication and CSRF protections, allowing unauthenticated attackers to execute arbitrary read (find) and write (updateMany) operations on the backing NoSQL data sources. This affects MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, and REST JSON collections but not SQL datasources. The vulnerability is confirmed in version 3.39.0 and earlier. A patch is available to fix this issue.

An unauthenticated attacker can exploit this vulnerability by sending specially crafted requests to publicly published Budibase apps with queries set to the PUBLIC role. This allows the attacker to read all documents from the underlying NoSQL data sources and, if a PUBLIC write query is published, modify every document in the collection. This results in a complete confidentiality and integrity breach of the affected data. The vulnerability does not affect SQL datasources. The CVSS v3.1 score is 10.0 (critical), reflecting network attack vector, no privileges required, no user interaction, scope change, and high confidentiality and integrity impact.

A patch is available for Budibase server versions up to 3.39.0. Users should upgrade to a fixed version above 3.39.0 as soon as possible. Until patched, avoid setting non-SQL queries (MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, REST JSON) to the PUBLIC role in published apps to prevent unauthenticated access. The vendor advisory confirms the availability of an official fix. No other mitigations are indicated or effective given the nature of the vulnerability.