Budibase server versions before 3.45.0 have an authorization bypass vulnerability in the GET /api/applications/:appId/appPackage endpoint. This flaw allows authenticated users to access another tenant's application metadata and source code without proper authorization. Sensitive details exposed include navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers.
CVE-2026-100687 is a vulnerability in Budibase Server versions before 3.45.0 where plaintext datasource credentials are exposed to unauthorized actors. This occurs because the server fails to redact sensitive information such as database passwords and API keys before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept these unredacted credentials during table save or delete operations.
Budibase server versions before 3.45.0 contain an improper privilege management vulnerability in the POST /api/global/groups/:groupId/apps endpoint. This flaw allows builders to bypass per-application authorization checks and assign themselves admin roles in other workspaces by modifying user group role mappings. The vulnerability enables privilege escalation across workspace boundaries.
Budibase server versions before 3.45.0 contain an authorization flaw in the GET /api/chat-links endpoint. This flaw allows users with builder access in one workspace to enumerate chat identity link records across all workspaces within the same tenant. Sensitive information exposed includes user IDs and external chat service identifiers from other workspaces that the attacker should not have access to.
CVE-2026-100682 is a high-severity vulnerability in Budibase Server versions before 3.45.0. It involves an arbitrary file write issue in the PWA icon upload endpoint, where user-supplied ZIP archives are extracted without proper symlink validation. Attackers with BUILDER role privileges can exploit this by crafting malicious ZIP files to write arbitrary files as root, potentially leading to remote code execution.
Budibase server versions prior to 3.45.0 contain a server-side request forgery (SSRF) vulnerability in the Microsoft Teams webhook endpoint. This flaw allows unauthenticated attackers to submit crafted POST requests with attacker-controlled serviceUrl values, which are persisted and used in subsequent bot replies. Exploitation can lead to the server sending live Microsoft OAuth access tokens to attacker-controlled hosts and enable blind internal network access. The vulnerability has a medium severity with a CVSS 4.0 score of 6.3.
Budibase server versions prior to 3.45.0 contain a vulnerability in the OpenAPI/Swagger import validator that allows authenticated builder users to read arbitrary local files. This occurs because external JSON reference resolution is not disabled, enabling attackers to embed file:// references to exfiltrate sensitive information such as environment variables, JWT secrets, API keys, and database credentials.
Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.
CVE-2026-72855 is a server-side request forgery (SSRF) vulnerability in Budibase server versions prior to 3.40.0. It affects the OpenAPI query import and REST query execution features, allowing authenticated builder-level users to bypass DNS pinning protections via DNS rebinding attacks. This enables attackers to manipulate hostname resolution to access internal HTTP services that are normally blocked. The vulnerability has a high severity score of 8.4 CVSS 4.0.
CVE-2026-72851 is a critical unauthenticated SQL injection vulnerability in Budibase server versions before 3.40.0. It occurs in webhook-triggered automations that use EXECUTE_QUERY steps, allowing attackers to send malicious JSON payloads to the webhook endpoint. Exploitation enables execution of SQL commands with builder-configured database credentials, potentially leading to data exfiltration, modification, and persistence in connected datasources such as Snowflake. A patch is available to remediate this issue.
CVE-2026-72850 is a critical path traversal vulnerability in Budibase server versions before 3.40.0. It allows authenticated users with builder privileges to upload files with crafted filenames containing traversal sequences (e.g., ..) that are not properly sanitized. These sequences are preserved during workspace export, enabling attackers to write arbitrary files outside the intended temporary directory to any location writable by the Budibase process.
Budibase server versions before 3.40.0 have a cross-site request forgery (CSRF) vulnerability in the chat-link handoff endpoint. This flaw allows attackers to bind an external chat identity to a victim's account by tricking the victim into submitting a crafted POST request with a leaked confirmation token. Successful exploitation enables impersonation within agent operations and inheritance of victim permissions.
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents.
Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.
Budibase, an open-source low-code platform for building internal applications, has multiple vulnerabilities that allow manipulation of files. These issues affect versions up to and including 3.39.0. No CVSS score is provided, and no known exploits are reported in the wild. The vulnerabilities were published by the Bundesamt für Sicherheit in der Informationstechnik. No patch or remediation information is currently available.
A vulnerability identified as CVE-2026-45717 affects Budibase, an open-source low-code platform used for creating internal applications such as admin panels. The issue allows an attacker to bypass security controls. The affected versions include Budibase versions prior to 3.38.1. There is no CVSS score available, no known exploits in the wild, and no patch or remediation information provided by the vendor. The vulnerability was published by the Bundesamt für Sicherheit in der Informationstechnik. Due to the lack of detailed technical information and absence of a vendor advisory specifying a fix, the patch status is not confirmed.
Budibase, an open-source low-code platform for building internal applications, has multiple vulnerabilities affecting versions prior to 3.38.2. These vulnerabilities are catalogued under CVE-2026-46424, CVE-2026-46425, CVE-2026-46426, and CVE-2026-46427. No CVSS scores or detailed technical descriptions are provided. There are no known exploits in the wild, and no patch or remediation information is currently available from the vendor advisory. The affected product is not a cloud service. Due to the lack of detailed impact or exploitability data, the severity is assessed as medium based on the presence of multiple vulnerabilities in a platform used for internal application development.
CVE-2026-45548 is a vulnerability in Budibase, an open-source low-code platform for building internal applications such as admin panels. The vulnerability allows for information disclosure in affected versions up to and including 3.34.4. There is no CVSS score or detailed technical information available about the nature or exploitation of the vulnerability. No known exploits are reported in the wild, and no official patch or remediation guidance is provided in the available data.