Threats affecting pkg:github/budibase/server

Budibase server versions 3.41.0 up to but not including 3.45.0 contain a critical authentication bypass vulnerability in the OIDC/SSO login path. The flaw allows an attacker who can register at a trusted IdP to claim a pending user invite by asserting the victim's invited email address without proper validation of the invite code or email verification. This enables the attacker to inherit all privileges granted to the invite, including admin rights, leading to full tenant compromise and denial of onboarding to the legitimate invitee.

CVE-2026-100683 is a high-severity SQL injection vulnerability in Budibase server versions before 3.45.0. It arises from improper neutralization of special characters in SQL commands when renaming database columns via the Budibase UI. An attacker with DDL rights on a connected MySQL or MSSQL datasource can exploit this to execute arbitrary SQL statements with the privileges of Budibase's datasource user. This allows unauthorized reads, writes, or destructive operations on the connected database, bypassing Budibase's permission model. The issue is fixed in version 3.45.0.