Threats tagged 'ghsa-8qv3-p479-cj62'

Budibase server versions up to 3.39.0 contain a critical NoSQL operator injection vulnerability (CVE-2026-54350) in the handling of published-app query templates. This flaw allows unauthenticated users to bypass authentication and CSRF protections when queries are set to the PUBLIC role, enabling them to read or modify all documents in various NoSQL data sources such as MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST JSON collections. The vulnerability arises from unsafe substitution of user input into JSON query bodies without proper escaping, combined with insufficient input validation and authorization checks. SQL datasources are not affected. A patch is available for this issue.