Budibase's MongoDB datasource integration improperly processes user-supplied parameters by enriching query JSON with Handlebars using no escaping, then parsing it with JSON.parse. This allows injection of MongoDB operators that override intended per-user filters. The injected query reaches MongoDB's find operation unchanged, enabling BASIC users to bypass access controls and read or modify all documents accessible by the connection. Unlike SQL datasources, the MongoDB path lacks parameterization, making it vulnerable to NoSQL injection. A duplicate-key JSON trick enables attackers to craft filters that match all documents, demonstrated in Budibase 3.35.8 with MongoDB 6.

An attacker with BASIC user privileges can bypass the builder's per-user query filters and access all documents in the MongoDB datasource, potentially exposing sensitive data. The injection also allows arbitrary update or delete operations, compromising data integrity. The vulnerability leads to a confidentiality breach (full data read access) and partial integrity impact (arbitrary updates/deletes). Availability is not affected. The severity is high due to the broad data exposure and privilege bypass.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using MongoDB datasources with untrusted user input in Budibase or restrict BASIC user permissions. Builders should not rely on handlebars-enriched JSON with no escaping for query filtering. Consider implementing server-side query parameterization or input validation to prevent injection. Monitor vendor channels for patches or official fixes.